CVE-2026-80192: Improper Authentication in better-auth sso

The vulnerability in better-auth sso before 1.6.27 (and specified earlier versions) consists of two domain-ownership flaws. First, if domain verification is disabled, an authenticated organization owner or administrator can register an SSO provider for any domain, causing users with matching email domains to be added to the attacker's organization with default member permissions. Second, when domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can cause completed DNS proof to be applied to a different domain. This, combined with implicit account linking, allows an attacker-controlled identity provider to be linked to an existing user account. Exploitation requires the sso plugin and, for the organization assignment path, the organization plugin with relevant configurations enabled. The vulnerability has a CVSS 4.0 score of 8.6 (high severity). The product is cloud-hosted, and the vendor manages remediation.

Successful exploitation can allow an attacker with authenticated organization owner or administrator privileges to register SSO providers for arbitrary domains, thereby adding users with matching email domains to the attacker's organization with default member permissions. Additionally, the race condition flaw can enable linking an attacker-controlled identity provider to an existing user account, potentially compromising account integrity and access control within the affected environment.

The vendor manages remediation for this cloud-hosted service. A patch is available for affected versions. Users should ensure they are running versions 1.6.27 or later (or the corresponding fixed versions in the 1.4.x and 1.7 prerelease lines). Verify that domain verification is enabled and properly configured to prevent exploitation of these flaws. Check the vendor advisory for the latest remediation guidance.