Threats affecting pkg:npm/@better-auth/sso

Better Auth sso versions from 1.7.0-rc.2 up to but not including 1.7.3 contain an authentication bypass vulnerability. This flaw allows authenticated users to impersonate other users by registering a personal SSO provider that mimics a legitimate provider's OIDC issuer or SAML entity ID. The vulnerability arises because the account lookup process ignores the providerId, enabling attackers to create sessions for victim accounts by asserting their subject or NameID.

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

The @better-auth/sso plugin versions >=0.1.0 and <1.6.11 contain a server-side request forgery (SSRF) vulnerability via unvalidated OpenID Connect (OIDC) endpoint URLs when skipDiscovery is set to true. Authenticated users can exploit this by registering malicious OIDC providers, causing the server to fetch attacker-controlled URLs. This can lead to reading internal HTTP responses, including cloud metadata services. If trustEmailVerified is enabled, attackers can escalate to account takeover by forging verified email claims that link to existing user accounts. The issue is fixed in version 1.6.11 by validating OIDC endpoint URLs against public routability or trusted origins and tightening schema validation. Workarounds include disabling provider self-registration, restricting access, network egress controls, and disabling trustEmailVerified until patched.