Veille CVE

Jeudi 15 octobre 2026

2 CVE sur 4

Critique 1 Élevée 2 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « better-auth » ✕
  1. CVE-2026-110864 7.4 Élevée

    better-auth

    Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.

  2. CVE-2026-110863 8.1 Élevée

    better-auth sso

    Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim's subject or NameID, because account lookup ignores providerId, creating sessions for victim accounts.