Better Auth sso versions from 1.7.0-rc.2 up to but not including 1.7.3 contain an authentication bypass vulnerability. This flaw allows authenticated users to impersonate other users by registering a personal SSO provider that mimics a legitimate provider's OIDC issuer or SAML entity ID. The vulnerability arises because the account lookup process ignores the providerId, enabling attackers to create sessions for victim accounts by asserting their subject or NameID.
CVE-2026-110861 is a race condition vulnerability in better-auth's drizzle-adapter and kysely-adapter affecting versions from 1.6.17 up to but not including 1.7.7 and 1.7.0 respectively. The flaw lies in the database-backed rate limiting on PostgreSQL where the check for rate limits is not atomic with the counter update. This allows remote attackers to send concurrent requests that bypass the intended rate limits on sensitive authentication endpoints such as password sign-in, two-factor verification, one-time code, and password reset.
CVE-2026-80192 is a high-severity improper authentication vulnerability in better-auth's sso plugin affecting multiple version lines before specific fixed versions. It involves two domain-ownership flaws: one allowing an authenticated organization owner/administrator to register an SSO provider for arbitrary domains when domain verification is disabled, and another race condition when domain verification is enabled that can link attacker-controlled identity providers to existing user accounts. Exploitation requires specific plugin configurations. A patch is available, and the service is cloud-hosted.
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
CVE-2026-15527 is a path traversal vulnerability in the better-auth better-icons component scan_project_icons/sync_icon affecting versions 1.0.0 through 1.0.5. The vulnerability allows local attackers with low privileges to manipulate the icons_file argument to perform path traversal. The vulnerability has a medium severity with a CVSS score of 4.8. The issue was publicly disclosed, but no official patch or remediation has been provided by the vendor as of the publication date.