CVE-2026-80192 better-auth CVE debrief

Who should care

Organizations using @better-auth/sso, especially those with domain verification disabled or specific SSO configurations, should be aware of the potential authentication bypass risks and take steps to patch and monitor their systems. This includes reviewing and updating SSO plugin configurations, monitoring for suspicious organization assignments and identity provider links, and ensuring that compensating controls are in place for exposed systems.

Technical summary

The @better-auth/sso library contains two domain-ownership flaws. When domain verification is disabled, an authenticated organization owner/administrator can register an SSO provider for an arbitrary domain, allowing users with matching email domains to be added to the attacker's organization. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain, potentially linking an attacker-controlled identity provider to an existing user account.

Defensive priority

Organizations using @better-auth/sso should prioritize patching to prevent potential authentication bypass attacks.

Recommended defensive actions

• Patch @better-auth/sso to version 1.6.27 or later
• Review and update SSO plugin configurations
• Monitor for suspicious organization assignments and identity provider links
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates two domain-ownership flaws in @better-auth/sso before 1.6.27. When domain verification is disabled, an authenticated organization owner/administrator can register an SSO provider for an arbitrary domain. When domain verification is enabled, a race condition can link an attacker-controlled identity provider to an existing user account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.