{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67328", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:07:47.015Z", "datePublished": "2026-08-01T12:22:17.940Z", "dateUpdated": "2026-08-14T16:50:54.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-14T16:50:54.741Z"}, "datePublic": "2026-06-26T00:00:00.000Z", "title": "@better-auth/sso before 1.6.21 Account Takeover via SSO", "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "better-auth", "product": "sso", "defaultStatus": "unaffected", "packageURL": "pkg:npm/better-auth/sso", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.6.21"}, {"version": "1.6.21", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "better-auth", "product": "sso", "defaultStatus": "unaffected", "packageURL": "pkg:npm/better-auth/sso", "versions": [{"version": "1.7.0-beta.0", "status": "affected", "versionType": "semver", "lessThan": "1.7.0-beta.10"}, {"version": "1.7.0-beta.10", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "1.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better-auth\\/sso:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "1.7.0-beta.0", "versionEndExcluding": "1.7.0-beta.10"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)"}, {"name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T19:39:11.641219Z", "id": "CVE-2026-67328", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:39:20.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67328", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T19:39:11.641219Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:39:16.672Z"}}], "cna": {"title": "@better-auth/sso before 1.6.21 Account Takeover via SSO", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "better-auth", "product": "sso", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.21", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}], "packageURL": "pkg:npm/better-auth/sso", "defaultStatus": "unaffected"}, {"vendor": "better-auth", "product": "sso", "versions": [{"status": "affected", "version": "1.7.0-beta.0", "lessThan": "1.7.0-beta.10", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}], "packageURL": "pkg:npm/better-auth/sso", "defaultStatus": "unaffected"}], "datePublic": "2026-06-26T00:00:00.000Z", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg", "name": "GitHub Security Advisory (GHSA-prpr-5gj3-qqhg)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso", "name": "VulnCheck Advisory: @better-auth/sso before 1.6.21 Account Takeover via SSO", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-01T12:22:17.940Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67328", "state": "PUBLISHED", "dateUpdated": "2026-08-03T19:39:20.435Z", "dateReserved": "2026-07-29T13:07:47.015Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:17.940Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/better-auth/sso", "product": "sso", "vendor": "better-auth", "versions": [{"lessThan": "1.6.21", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/better-auth/sso", "product": "sso", "vendor": "better-auth", "versions": [{"lessThan": "1.7.0-beta.10", "status": "affected", "version": "1.7.0-beta.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover."}], "id": "CVE-2026-67328", "lastModified": "2026-09-08T20:34:34.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67328", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T19:39:11.641219Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:03.380", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}