The vulnerability allows attackers to bypass authentication when using @better-auth/sso with a SAML identity provider, enabling them to sign in as any user. The flaws arise from mismatched domain verification parsing, orphaned provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. An attacker who can trigger these conditions can obtain an unauthorized session that grants full account access, potentially exposing sensitive data and permitting further malicious actions. The weakness is classified as CWE‑79, a web input validation failure that leads to authentication bypass.

All installations of the @better-auth/sso library with a version earlier than 1.6.21 are impacted. The product is published under the "better-auth" vendor, with the affected component named "sso". No vendor‑specific version list beyond the <1.6.21 cutoff is provided, so any prior release should be considered vulnerable.

The CVSS score of 8.6 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the expertise required to abuse the flaws suggests a remote web‑based attack via the SSO integration point. Exploitation would require a malicious identity provider or an attacker capable of forging SAML assertions against the victim’s configured SSO flow; such conditions make the attack realistic in scenarios where third‑party identity providers are used without strict validation.