Summary
Multiple flaws in the SSO provider handling of @better-auth/sso allow attackers to bypass authentication and log in as arbitrary users.
By exploiting domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints, attackers can gain unauthorized sessions and potentially take over accounts.
Affected context
This vulnerability arises in applications that integrate @better-auth/sso as their single sign-on middleware.
It is most relevant where:
- SSO identity providers are loosely validated or misconfigured
- Domain verification and redirect handling rely on flexible parsing rules
- SAML assertions are not tightly bound to sessions, audiences, or nonces
- Logout or session termination endpoints reflect user-controlled input into HTML or scripts
Environments that depend entirely on SSO for user identity and lack compensating controls are particularly exposed.
Exploit preconditions
- Attack surface: Public-facing SSO flows (login, logout, SAML or OIDC callbacks) exposed on web applications using @better-auth/sso.
- Required access: Ability to:
- Control or influence SSO parameters (domains, redirect URIs, SAML assertions), or
- Trigger crafted logout URLs containing attacker-controlled input, or
- Abuse stale or orphaned SSO provider account mappings.
- Trigger point: Invoking the SSO login/logout endpoints, domain verification routines, or assertion processing paths with crafted values.
- Why exploitation is possible:
- Domain verification parsing inconsistencies allow an attacker-controlled domain or URL to be treated as trusted.
- Orphaned provider accounts remain linked to application identities without clear ownership checks.
- SAML assertions are accepted without strict binding to audience, issuer, or session context.
- Reflected XSS on logout endpoints enables execution of attacker-supplied script in the context of a logged-in user, allowing session theft or forced SSO flows.
Why this happens
The root cause spans several related bugs, all centering on insufficient trust boundaries and input validation in SSO handling logic.
From a CWE perspective, the highlighted primary class is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from logout endpoints that reflect attacker-controlled parameters back into HTML or script contexts without proper encoding. This enables reflected XSS, which can be chained to hijack SSO sessions or inject malicious SSO flows.
Complementing this, the SSO implementation exhibits weak binding between identities and assertions:
- Domain verification relies on parsing logic that can be confused by subtle variations in hostnames, schemes, or paths, leading to misclassification of untrusted domains as trusted.
- Orphaned provider accounts remain active or reusable after their original linkage context changes, undermining assumptions about identity continuity.
- SAML assertions are accepted without rigorous checks on audience, issuer, replay, and linkage to the current session, which allows assertion re-use or misuse across accounts.
Conceptually, the insecure pattern is: treating externally supplied identity artifacts (domains, assertions, logout parameters) as trustworthy without consistent normalization, encoding, or contextual binding, enabling attackers to bypass authentication guarantees.
Potential impact
- Attackers can gain unauthorized access to user accounts by signing in as arbitrary users.
- Application sessions may be hijacked through reflected XSS on logout endpoints.
- SAML assertions could be replayed or misrouted, allowing cross-account or cross-tenant access.
- Orphaned provider account mappings may allow reattachment of identities to new or malicious accounts.
- Users' sensitive data and actions (including administrative functions) can be exposed or misused.
- Downstream services that rely on SSO-derived identity may be indirectly compromised.
General mitigation guidance
Effective mitigation focuses on hardening SSO processing paths and enforcing strict trust boundaries:
- Sanitize and encode user-controlled output:
- Apply context-appropriate output encoding for all parameters rendered in logout or SSO status pages.
- Avoid reflecting raw query parameters into HTML, JavaScript, or attributes; favor fixed templates and server-controlled messages.
- Normalize and strictly validate domains and redirect URIs:
- Use canonicalization routines that normalize schemes, hosts, ports, and paths before comparison.
- Maintain allowlists of exact domains and callback paths; avoid substring or pattern-based checks that can be confused.
- Strengthen SAML and SSO assertion binding:
- Enforce strict checks on issuer, audience, expiration, and single-use constraints.
- Bind assertions to the current session or request context, including CSRF-safe state parameters and nonces.
- Disallow assertions that do not map cleanly and currently to a single, verified user account.
- Manage provider account lifecycle explicitly:
- Ensure that when local user accounts or SSO provider links are removed or changed, associated provider identities cannot be reused unintentionally.
- Periodically reconcile and clean up orphaned identities as part of account lifecycle management.
- Apply least privilege and defense-in-depth:
- Treat SSO identity as one signal among others where possible (e.g., additional risk checks for high-value operations).
- Limit exposure of SSO endpoints, and require secure transport and cookie flags to reduce session misuse.
These patterns aim to reduce trust in external identity data, ensure that identity assertions are tightly bound to context, and prevent attacker-controlled content from influencing page rendering.
How teams detect issues like this
Organizations can detect and monitor for issues in SSO handling through multiple complementary approaches:
- Static analysis and linting:
- Flag direct insertion of request parameters into templates, particularly in login/logout flows.
- Search for constructs that write user input into HTML, JavaScript, or meta refresh tags without encoding.
- Identify domain verification routines that rely on substring matches, loose regex checks, or unnormalized URLs.
- Security-focused code review:
- Inspect SSO login, logout, and callback handlers for:
- Direct use of query/path parameters in redirects or session assignment.
- Missing verification of SAML/OIDC fields (issuer, audience, timestamps, signature).
- Incomplete handling of unlinking or deleting provider accounts.
- Pay special attention to flows that create or attach local accounts based on external identity without secondary checks.
- Runtime monitoring and logging:
- Log unusual SSO events, such as:
- Login attempts where the SSO subject changes but originates from unexpected domains.
- Repeated logout requests with suspicious parameters or script-like patterns.
- Multiple accounts linking to the same provider identity.
- Use anomaly detection to flag unusual login patterns or assertion reuse.
- Automated security testing:
- Employ dynamic security testing and automated scanners to probe logout and SSO endpoints for reflected XSS.
- Use SSO testing tools to simulate tampered or replayed assertions and verify that they are rejected.
These detection strategies help surface both direct XSS exposure and deeper identity binding flaws before they are exploited in production.
