CVE-2026-110863
Description
A flaw was found in @better-auth/sso. An authenticated attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to other user accounts by registering a custom Single Sign-On (SSO) provider. Because the application ignores the provider identifier during account lookup, an attacker can replicate a legitimate identity provider's identifiers and assert a target user's identity. This allows the attacker to establish an active session and impersonate arbitrary victim accounts.
Statement
This vulnerability is rated with an Important severity impact because an authenticated user can hijack arbitrary sessions and impersonate legitimate users without administrative privileges, leading to a high compromise of confidentiality and integrity. The risk is constrained to environments where custom or personal Single Sign-On identity provider registration is permitted, preventing a Critical rating. Currently, Red Hat does not ship or support the @better-auth/sso package in any active product offerings.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
