CVE-2026-67328 better-auth CVE debrief

Who should care

Defenders responsible for @better-auth/sso deployments should assess exposure and prioritize upgrading to version 1.6.21 or later to prevent authentication bypass attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update SSO provider configurations to prevent authentication bypass attacks. They should also monitor for suspicious login activity and implement additional

Why it matters

CVE-2026-67328 is a high-severity authentication bypass vulnerability in @better-auth/sso that allows attackers to sign in as arbitrary users. Defenders should prioritize verifying and upgrading to version 1.6.21 or later to prevent authentication bypass attacks. The vulnerability has a CVSS score of 8.6 and is considered high severity.

• Potential unauthorized session access and account takeover
• Possible lateral movement within the affected system

Technical summary

CVE-2026-67328 is an authentication bypass vulnerability in @better-auth/sso versions before 1.6.21. The vulnerability allows attackers to sign in as arbitrary users by exploiting domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints. This vulnerability has a CVSS score of 8.6 and is considered high severity. Defenders should prioritize verifying and upgrading to version 1.6.21 or later to prevent authentication bypass attacks. The vulnerability can lead to potential unauthorized session access and account takeover, as well as possible lateral movement within the affected system.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.6.21 or later of @better-auth/sso to prevent authentication bypass attacks.

Recommended defensive actions

• Verify and upgrade to version 1.6.21 or later of @better-auth/sso
• Review and update SSO provider configurations to prevent authentication bypass attacks
• Monitor for suspicious login activity and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on multiple authentication bypass vulnerabilities in @better-auth/sso versions before 1.6.21. The vulnerabilities allow attackers to sign in as arbitrary users by exploiting domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints. Defenders should verify and upgrade to version 1.6.21 or later to prevent authentication bypass attacks. The CVE record was published on 2026-08-01T13:17:03.380Z and has not been modified. A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.