CVE-2026-80192: @better-auth/sso Domain-Ownership Flaws Allow Organization Takeover and Account Linking

Executive Summary

A critical vulnerability, CVE-2026-80192, has been discovered in the @better-auth/sso package. This vulnerability has a CVSS score of 8.1 and can be exploited by attackers to register an SSO provider for an arbitrary domain or link an attacker-controlled identity provider to an existing user account. This flaw affects versions before 1.6.27, 1.4.8, and 1.7.0-rc.5 of the @better-auth/sso package.

Technical Analysis

The CVE-2026-80192 vulnerability involves two domain-ownership flaws in the @better-auth/sso package. The first flaw occurs when domain verification is disabled. In this scenario, an authenticated organization owner/administrator can register an SSO provider for an arbitrary domain. Consequently, users with matching email domains can be added to the attacker's organization with default member permissions. The second flaw arises when domain verification is enabled. A race condition between the verify-domain and update-provider endpoints can apply completed DNS proof to a different domain. When combined with implicit account linking, this can link an attacker-controlled identity provider to an existing user account. Exploitation of this vulnerability requires the SSO plugin (and, for the organization-assignment path, the organization plugin) with the relevant configuration enabled.

How It Gets Exploited

An attacker can exploit this vulnerability in the following manner: - The attacker starts as an authenticated organization owner/administrator. - They register an SSO provider for an arbitrary domain using the @better-auth/sso plugin. - If domain verification is disabled, users with matching email domains are automatically added to the attacker's organization with default member permissions. - If domain verification is enabled, the attacker can trigger a race condition between the verify-domain and update-provider endpoints. - This race condition allows the attacker to apply completed DNS proof to a different domain, effectively linking their controlled identity provider to an existing user account.

Impact Assessment

The impact of CVE-2026-80192 is significant, with a CVSS score of 8.1 indicating a high severity level. Successful exploitation can lead to organization takeover and account linking, potentially compromising the confidentiality and integrity of affected systems. The vulnerability affects users of @better-auth/sso versions before 1.6.27, 1.4.8, and 1.7.0-rc.5.

Recommended Actions

To mitigate CVE-2026-80192, the following actions are recommended: - Update @better-auth/sso to version 1.6.27 or later. - For users on the 1.4.x line, update to version 1.4.8 or later. - For users on the 1.7 prerelease line, update to version 1.7.0-rc.5 or later. - Ensure that the SSO plugin and organization plugin (if applicable) are properly configured and monitored. - Implement additional monitoring to detect potential exploitation attempts.

Sources

- National Vulnerability Database (NVD)