CVE-2026-110863

Executive Summary

CVE-2026-110863 is an authentication bypass in the @better-auth/sso package of the Better Auth framework, affecting versions from 1.7.0-rc.2 up to (but not including) 1.7.3. Any authenticated user can register a personal SSO provider that impersonates a legitimate OIDC issuer or SAML entity ID and assert a victim's subject or NameID, causing the system to create a valid session for the victim's account. Because account lookup ignores providerId, the flaw enables full account takeover across any deployment exposing the vulnerable SSO plugin, with high confidentiality and integrity impact (CVSS 8.1).

Technical Analysis

Better Auth is a TypeScript/JavaScript authentication framework, and @better-auth/sso adds OpenID Connect (OIDC) and SAML single sign-on capability. The vulnerability is rooted in how the SSO plugin resolves an incoming identity assertion to a local user account after a successful provider callback.

Per the NVD description, the flaw is twofold:

1. Provider registration is insufficiently scoped. An authenticated (low-privilege) user can register a personal SSO provider. In the affected versions, nothing prevents that user from configuring the provider's OIDC issuer or SAML entity ID to match a legitimate, already-configured corporate provider — i.e., copying a trusted provider's identifier verbatim.

2. Account lookup ignores providerId. When the assertion is processed, the account resolution path matches on the asserted subject (OIDC sub) or SAML NameID, but does not constrain the match to the provider the assertion legitimately came from. The providerId dimension of the lookup is dropped. As a result, an attacker who controls an SSO provider that shares a victim provider's issuer/entity ID can present a subject/NameID value equal to the victim's and be mapped onto the victim's local account.

The net effect is a broken trust boundary in identity federation: the (issuer/entityID, subject) tuple is only unique within a provider, but the code treats the subject as globally unique. This is a CWE-287 (Improper Authentication) condition — an identity is asserted and accepted without verifying that the asserting provider is the same entity that originally bound that subject to the account.

The attack surface is the SSO plugin's provider-registration endpoint and the OIDC/SAML callback/assertion-consumer path. Both are network-reachable (AV:N), require the attacker to already hold some valid account to register a provider (PR:L), require no user interaction from the victim (UI:N), and are scoped to the vulnerable component (S:U). Only confidentiality and integrity are impacted (C:H/I:H), with no integrity of the authentication service itself assumed beyond the authorization decision (A:N).

The packages are distributed via npm as @better-auth/sso; any application that has installed a version in the >= 1.7.0-rc.2 < 1.7.3 range and enabled the SSO plugin with at least one configurable provider is potentially exposed. No public exploit code, PoC, or Nuclei template was identified at the time of this report, so the exact request payloads and callback semantics remain unconfirmed; the mechanics above are derived strictly from the vendor/NVD description of the flaw class.

Note: the CVE's providerId handling defect is an authorization-scoping bug, not a cryptographic break of OIDC signatures or SAML assertions — the attacker's assertion can carry a valid signature from the attacker-controlled provider while still being accepted for the victim's account because provider binding is not enforced during lookup.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the described vulnerability class (improper authentication via provider-scoping bypass). It uses only the concepts named in the description: personal SSO provider, OIDC issuer, SAML entity ID, subject, NameID, providerId, and account lookup.

1. Reconnaissance / target identification. The attacker first needs a low-privilege account on the target Better Auth deployment (e.g., self-registration or a compromised low-value account). They then enumerate or infer the legitimate SSO configuration — the corporate OIDC issuer URL or the SAML entity ID of the trusted IdP. These identifiers are frequently observable in client-side metadata, well-known discovery documents, error messages, or login-redirect parameters, and are not secrets.

2. Triggering the flaw (provider registration). Using their authenticated session, the attacker registers a personal SSO provider through the plugin's provider-configuration functionality. In this registration, they set the provider's OIDC issuer (or SAML entity ID) to exactly match the legitimate provider's identifier. Because registration in the affected versions does not reject collisions with existing/protected providers, the attacker's malicious provider now shares an identity with the trusted one.

3. Payload/execution (assertion with victim subject/NameID). The attacker initiates an SSO login against their personal provider and crafts the identity assertion so that the subject (sub for OIDC) or NameID (for SAML) equals the victim's value — e.g., the victim's email/UPN or known subject identifier. The account-lookup routine matches on that subject/NameID without constraining on providerId, so it resolves the assertion to the victim's local account rather than rejecting it as belonging to a different provider.

4. Post-exploitation impact. The framework issues a session for the victim's account. The attacker is now authenticated as the victim — full account takeover. Depending on the victim's role, this yields access to the victim's data and privileges (high confidentiality and integrity impact). The attacker can repeat the procedure for additional victims whose subject/NameID values they can determine, enabling lateral movement and persistent impersonation until the session is revoked or the configuration is fixed. Because the flaw is in session establishment, standard token revocation and forced re-authentication of affected users are the primary containment levers.

Impact Assessment

Successful exploitation results in full account takeover of any targeted user on an affected deployment. With CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw is rated High severity: it is remotely exploitable over the network with no special conditions, requires only a low-privileged authenticated account, and needs no victim interaction. Confidentiality and integrity impacts are High — an attacker can read and act as the victim (data exfiltration, privileged actions, password/email changes, access to downstream systems trusting the victim's identity). Availability is not directly impacted.

Blast radius: every user account in the tenant that can be impersonated by subject/NameID. In enterprise SSO deployments, a single takeover of an administrator or service account can cascade to downstream SaaS and internal resources that federate through Better Auth. Because the flaw is in the shared @better-auth/sso package, any application bundling an affected version and enabling configurable providers inherits the exposure. Confidence in exploitation preconditions: the attacker must hold at least one valid account and know or guess the victim's subject/NameID — both are typically low bars in multi-tenant or self-registration-enabled environments.

Detection Guidance

Sigma Rule

title: Better Auth SSO Personal Provider Registration and Impersonation Attempt
id: 8f4c1b2e-9a7d-4c3f-b6e1-0d2a7c5e9f11
status: experimental
description: Detects registration of personal SSO providers and authentication events where account lookup resolves to a different provider than the assertion (CVE-2026-110863).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110863
author: valtersit.com
date: 2026/01/01
logsource:
  product: better-auth
  service: sso
detection:
  selection_register:
    event:
      - 'sso.provider.register'
      - 'sso.provider.create'
    providerOwner: 'personal'
  selection_collision:
    issuer_or_entityid: '*'
  selection_lookup:
    event: 'sso.login.success'
    providerId_mismatch: true
  condition: selection_register or (selection_register and selection_collision) or selection_lookup
falsepositives:
  - Legitimate personal provider creation in self-service tenants
  - Administrative provider reconciliation jobs
level: high
tags:
  - attack.t1078
  - cwe.287

YARA Rule

rule CVE_2026_110863_BetterAuth_SSO_Provider_Bypass
{
    meta:
        description = "Detects Better Auth SSO plugin builds vulnerable to provider-scoping auth bypass (CVE-2026-110863)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110863"
        severity = "high"

    strings:
        $pkg1 = "@better-auth/sso" ascii
        $ver1 = "1.7.0-rc.2" ascii
        $ver2 = "1.7.1" ascii
        $ver3 = "1.7.2" ascii
        $lookup = "providerId" ascii
        $issuer = "issuer" ascii
        $nameid = "NameID" ascii
        $entityid = "entityID" ascii
        $sub = "subject" ascii

    condition:
        uint16(0) == 0x7A7B or $pkg1 or
        ($lookup and ($issuer or $entityid) and ($nameid or $sub)) and
        any of ($ver*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110863 Better Auth SSO - Provider Registration with Duplicate Issuer/EntityID"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"sso"; nocase; http.uri; content:"provider"; nocase; http.request_body; content:"issuer"; nocase; http.request_body; content:"entityID"; nocase; nocase; reference:cve,2026-110863; classtype:attempted-user; sid:2026110863; rev:1;)

alert http any any -> any any (msg:"CVE-2026-110863 Better Auth SSO - Suspicious SAML NameID Assertion"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"sso"; nocase; http.request_body; content:"SAMLResponse"; nocase; http.request_body; content:"NameID"; nocase; reference:cve,2026-110863; classtype:attempted-user; sid:2026110864; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [ authentication where event.action == "sso.provider.register"
      and better_auth.sso.provider_owner == "personal" ]
  [ authentication where event.action == "sso.login.success"
      and better_auth.sso.provider_id_mismatch == true ]

Splunk SPL Query

index=better_auth sourcetype=better_auth:sso
| search event IN ("sso.provider.register","sso.provider.create","sso.login.success")
| eval is_register=if(event=="sso.provider.register" OR event=="sso.provider.create","1","0")
| eval is_mismatch=if(event=="sso.login.success" AND provider_id_mismatch="true","1","0")
| stats sum(is_register) as registrations sum(is_mismatch) as mismatches by user, src_ip
| where registrations > 0 AND mismatches > 0
| table _time, user, src_ip, registrations, mismatches
| sort - mismatches

Wazuh OSSEC Rule

<group name="better_auth,sso,auth_bypass,">
  <rule id="1108631" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">sso\.provider\.(register|create)</field>
    <field name="providerOwner">personal</field>
    <description>CVE-2026-110863: Personal SSO provider registration detected (potential impersonation setup)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="1108632" level="14">
    <decoded_as>json</decoded_as>
    <field name="event">sso\.login\.success</field>
    <field name="providerId_mismatch">true</field>
    <description>CVE-2026-110863: SSO login with providerId mismatch - possible account takeover</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, workaround, or OSV package entry is available at the time of writing.

1. Immediate mitigations

   • Disable or restrict personal/self-service SSO provider registration. If the plugin allows any authenticated user to create a provider, gate that capability to administrators only or remove it entirely.
   • Restrict the SSO plugin's provider-registration endpoint at the reverse proxy/WAF so only trusted administrative callers can reach it.
   • Restrict and monitor the OIDC/SAML callback endpoints; allow callbacks only from expected IdP source IPs where feasible.
   • Force re-authentication and revoke active sessions for accounts that may have been targeted, and rotate credentials for any account suspected of takeover.
   • Audit the provider configuration table for duplicate/conflicting OIDC issuer or SAML entity ID values — any collision between a personal provider and a legitimate one is a red flag.

2. Patch / upgrade steps

   • Monitor the Better Auth project and NVD for the release of a fixed @better-auth/sso version. Per the affected range, 1.7.3 is the first version documented as outside the vulnerable range; upgrade to 1.7.3 or later once it is confirmed available and validated in your environment.
   • After upgrading, re-verify that account lookup enforces providerId binding (issuer/entity ID + subject/NameID) before accepting a session.
   • Run npm ls @better-auth/sso / review lockfiles to inventory affected versions across all services and redeploy.

3. Long-term hardening

   • Enforce strict issuer/entity ID uniqueness and immutability for SSO providers; reject registration of a provider that collides with an existing trusted identifier.
   • Bind all federated accounts on the tuple (providerId, subject/NameID) — never on subject/NameID alone.
   • Require administrator approval for any new SSO provider and periodically reconcile provider configurations.
   • Prefer pinned, audited dependencies with SBOM tracking and automated alerts for authentication-framework CVEs.

References

• NVD — CVE-2026-110863: https://nvd.nist.gov/vuln/detail/CVE-2026-110863
• CWE-287: Improper Authentication — https://cwe.mitre.org/data/definitions/287.html
• Better Auth project documentation / SSO plugin (vendor) — https://www.better-auth.com/docs
• npm package registry — @better-auth/sso — https://www.npmjs.com/package/@better-auth/sso
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/

No CISA KEV entry, no public proof-of-concept/exploit code, and no known threat actor campaign or exploit-in-the-wild evidence were identified for this CVE at the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.