CVE-2026-67328 better-auth CVE debrief

Who should care

Organizations using @better-auth/sso versions before 1.6.21 should be aware of the potential authentication bypass vulnerability and take steps to mitigate it. This includes reviewing and updating authentication configurations, monitoring for suspicious activity, and prioritizing upgrades to a patched version. Security teams and vulnerability management teams should also be aware of the vulnerability and its potential impact on their systems.

Technical summary

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover. Organizations should prioritize upgrading to a patched version to prevent potential authentication bypass attacks.

Defensive priority

Organizations using @better-auth/sso versions before 1.6.21 should prioritize upgrading to a patched version to prevent potential authentication bypass attacks.

Recommended defensive actions

• Upgrade to @better-auth/sso version 1.6.21 or later
• Review and update authentication configurations
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to fully understand the impact and affected scope. Organizations should verify their deployments, review official advisories, and monitor for suspicious activity. The vulnerability affects @better-auth/sso versions before 1.6.21, and attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

Official resources