What is GHSA-8g2f-78cq-p655?

GHSA-8g2f-78cq-p655 is a security advisory published by GitHub Security Advisories with High severity. @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in...

Which CVE IDs does GHSA-8g2f-78cq-p655 cover?

GHSA-8g2f-78cq-p655 covers the following CVE IDs: CVE-2026-67328. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8g2f-78cq-p655?

GHSA-8g2f-78cq-p655 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-8g2f-78cq-p655HighCVSS 8.1

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-67328 →

📋 Description

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

🔗 References (4)

https://github.com/better-auth/better-auth/security/advisories/GHSA-prpr-5gj3-qqhg
https://nvd.nist.gov/vuln/detail/CVE-2026-67328
https://www.vulncheck.com/advisories/better-auth-sso-before-account-takeover-via-sso
https://github.com/advisories/GHSA-8g2f-78cq-p655