CVE-2026-67328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67328", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:07:47.015Z", "datePublished": "2026-08-01T12:22:17.940Z", "dateUpdated": "2026-10-08T15:24:07.140Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:07.140Z"}, "datePublic": "2026-06-26T00:00:00.000Z", "title": "@better-auth/sso before 1.6.21 Account Takeover via SSO", "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "better-auth", "product": "sso", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/sso", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.6.21"}, {"version": "1.6.21", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "better-auth", "product": "sso", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/sso", "versions": [{"version": "1.7.0-beta.0", "status": "affected", "versionType": "semver", "lessThan": "1.7.0-beta.10"}, {"version": "1.7.0-beta.10", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "1.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "1.7.0-beta.0", "versionEndExcluding": "1.7.0-beta.10"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)"}, {"name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T19:39:11.641219Z", "id": "CVE-2026-67328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:39:20.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T19:39:11.641219Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:39:16.672Z"}}], "cna": {"title": "@better-auth/sso before 1.6.21 Account Takeover via SSO", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "better-auth", "product": "sso", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.21", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/sso", "defaultStatus": "unaffected"}, {"vendor": "better-auth", "product": "sso", "versions": [{"status": "affected", "version": "1.7.0-beta.0", "lessThan": "1.7.0-beta.10", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/sso", "defaultStatus": "unaffected"}], "datePublic": "2026-06-26T00:00:00.000Z", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg", "name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso", "name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.6.21"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.7.0-beta.10", "versionStartIncluding": "1.7.0-beta.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:07.140Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67328", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:24:07.140Z", "dateReserved": "2026-07-29T13:07:47.015Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:17.940Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/sso", "product": "sso", "vendor": "better-auth", "versions": [{"lessThan": "1.6.21", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/sso", "product": "sso", "vendor": "better-auth", "versions": [{"lessThan": "1.7.0-beta.10", "status": "affected", "version": "1.7.0-beta.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}, {"lang": "es", "value": "Las versiones de @better-auth/sso anteriores a la 1.6.21 contienen m\u00faltiples vulnerabilidades de omisi\u00f3n de autenticaci\u00f3n en el manejo del proveedor de SSO que permiten a los atacantes iniciar sesi\u00f3n como usuarios arbitrarios. Los atacantes pueden explotar desajustes en el an\u00e1lisis de verificaci\u00f3n de dominio, cuentas de proveedor hu\u00e9rfanas, aserciones SAML no vinculadas o XSS reflejado en los puntos finales de cierre de sesi\u00f3n para obtener acceso no autorizado a la sesi\u00f3n y la toma de control de la cuenta."}], "id": "CVE-2026-67328", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67328", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T19:39:11.641219Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:03.380", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.21)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.6.21"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sso", "source": "cna", "vendor": "better-auth"}, "product": "sso", "vendor": "better-auth"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0-beta.0,1.7.0-beta.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.7.0-beta.10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sso", "source": "cna", "vendor": "better-auth"}, "product": "sso", "vendor": "better-auth"}], "created": "2026-08-02T03:15:03.823608+00:00", "updated": "2026-08-02T20:31:35.143158+00:00", "vendors": ["better-auth", "better-auth$PRODUCT$sso"]}