Summary
Better Auth SSO contains an authentication bypass that can allow an authenticated user to sign in as another account by registering a personal SSO provider.
The issue becomes risky when the attacker can reuse a legitimate provider identifier and assert a victim's OIDC subject or SAML NameID, potentially creating a session for the victim account.
Better Auth SSO contains an authentication bypass that can allow an authenticated user to sign in as another account by registering a personal SSO provider.
The issue becomes risky when the attacker can reuse a legitimate provider identifier and assert a victim's OIDC subject or SAML NameID, potentially creating a session for the victim account.
Affected context
The vulnerability affects Better Auth deployments using the @better-auth/sso component within the affected release range. It occurs when users are allowed to register personal SSO providers and account lookup relies on an external subject or NameID without sufficiently binding that identifier to the specific provider.
The vulnerability affects Better Auth deployments using the @better-auth/sso component within the affected release range. It occurs when users are allowed to register personal SSO providers and account lookup relies on an external subject or NameID without sufficiently binding that identifier to the specific provider.
Exploit preconditions
- Attack surface: SSO authentication and personal provider registration
- Required access: An authenticated application account with permission to register or configure a personal SSO provider
- Trigger point: Sign-in through the attacker-controlled or attacker-registered SSO provider
- Why exploitation is possible: Account lookup does not adequately include the provider identity, allowing a copied issuer or entity ID combined with a victim subject or NameID to resolve to the victim account
- Attack surface: SSO authentication and personal provider registration
- Required access: An authenticated application account with permission to register or configure a personal SSO provider
- Trigger point: Sign-in through the attacker-controlled or attacker-registered SSO provider
- Why exploitation is possible: Account lookup does not adequately include the provider identity, allowing a copied issuer or entity ID combined with a victim subject or NameID to resolve to the victim account
Why this happens
The underlying flaw is an authentication identity-binding failure. The application treats an external account identifier, such as an OIDC subject or SAML NameID, as sufficient for account lookup without reliably scoping it to the trusted provider that issued it.
This maps to CWE-287: Improper Authentication, because the system can accept an assertion that does not establish ownership of the target account within the correct identity-provider context.
The underlying flaw is an authentication identity-binding failure. The application treats an external account identifier, such as an OIDC subject or SAML NameID, as sufficient for account lookup without reliably scoping it to the trusted provider that issued it.
This maps to CWE-287: Improper Authentication, because the system can accept an assertion that does not establish ownership of the target account within the correct identity-provider context.
Potential impact
- An authenticated user may impersonate another application account
- Attackers could access data and actions available to the victim account
- Account-specific settings, sessions, or linked resources may be exposed or modified
- Administrative or business-impacting actions could be performed if a privileged account is targeted
- An authenticated user may impersonate another application account
- Attackers could access data and actions available to the victim account
- Account-specific settings, sessions, or linked resources may be exposed or modified
- Administrative or business-impacting actions could be performed if a privileged account is targeted
General mitigation guidance
Mitigation typically focuses on binding every external identity to its authenticated provider context and preventing user-controlled providers from resolving to existing accounts without strong verification.
Common defensive patterns include:
- Use a composite identity key containing the provider, issuer or entity ID, and subject or NameID
- Validate issuer, audience, signature, and provider registration before account lookup
- Separate personal provider identities from trusted organizational SSO identities
- Require explicit account linking or reauthentication before associating an external identity with an existing account
- Apply least privilege to provider-registration and account-linking operations
- Treat external identity claims as untrusted until validated against the registered provider configuration
Mitigation typically focuses on binding every external identity to its authenticated provider context and preventing user-controlled providers from resolving to existing accounts without strong verification.
Common defensive patterns include:
- Use a composite identity key containing the provider, issuer or entity ID, and subject or NameID
- Validate issuer, audience, signature, and provider registration before account lookup
- Separate personal provider identities from trusted organizational SSO identities
- Require explicit account linking or reauthentication before associating an external identity with an existing account
- Apply least privilege to provider-registration and account-linking operations
- Treat external identity claims as untrusted until validated against the registered provider configuration
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Static analysis and code review of account lookup functions handling OIDC subjects or SAML NameIDs
- Checks that provider identifiers are included in external-identity database keys and queries
- Review of personal SSO registration and account-linking workflows for missing ownership verification
- Authentication telemetry correlating provider registrations, issuer or entity ID reuse, and unexpected account changes
- Policy enforcement requiring explicit reauthentication for linking external identities to existing accounts
Automated security review tools may help identify authentication lookups that use user identifiers without provider scoping.
Organizations commonly detect this class of issue through:
- Static analysis and code review of account lookup functions handling OIDC subjects or SAML NameIDs
- Checks that provider identifiers are included in external-identity database keys and queries
- Review of personal SSO registration and account-linking workflows for missing ownership verification
- Authentication telemetry correlating provider registrations, issuer or entity ID reuse, and unexpected account changes
- Policy enforcement requiring explicit reauthentication for linking external identities to existing accounts
Automated security review tools may help identify authentication lookups that use user identifiers without provider scoping.
