Better Auth @better-auth/sso contains an authentication failure flaw that lets an authenticated user create a personal SSO provider with a valid issuer or entity ID, and then assert a victim's subject or NameID. Because the account lookup process ignores the provider identifier, the system treats the forged assertion as a legitimate login and establishes a session for the victim account. This flaw allows the attacker to sign in as arbitrary users within the same application instance, effectively bypassing authentication constraints and enabling unauthorized access to user data.

This vulnerability affects the better-auth sso component in all releases from 1.7.0‑rc.2 up to, but not including, 1.7.3. The affected product is Better Auth sso with versions earlier than 1.7.3.

The CVSS score of 8.6 indicates a High severity level, and the EPSS score is not available, though the lack of EPSS does not mean exploitation is impossible. The vulnerability is not currently listed in the CISA KEV catalog. An attacker would need to first authenticate to register the rogue SSO provider, then use the crafted provider to target a victim. Because a single authenticated session can be leveraged to impersonate any other user, the risk to integrity and confidentiality is significant if the application handles sensitive data. Organizations should treat this flaw as a critical risk until a fixed version is applied.