CVE-2026-67328CWE-79cross-site-scripting

CVE-2026-67328

High · published August 1, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00491 · 41.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-01T17:17Z
References (2)
https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg · [email protected]https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso · [email protected]
EPSS history
Timeline
  • 01 AUG 12:22Z
    @better-auth/sso before 1.6.21 Account Takeover via SSO
    cvelistv5