A high-severity cross-site scripting flaw in the Better-auth SSO component allows an authenticated attacker to compromise user accounts.

The vulnerability is a cross-site scripting (XSS) issue, identified as CWE-79, which occurs due to improper neutralization of input. An attacker with low-level authenticated access can exploit this to perform unauthorized actions, leading to full account takeover.

Successful exploitation leads to unauthorized account access and potential data exfiltration, representing a high risk to user privacy and organizational security. With a CVSS score of 8.1, the vulnerability requires immediate remediation to prevent the escalation of privileges and compromise of sensitive user information.

Immediate Action: Update Better-auth SSO to version 1.6.21 or 1.7.0-beta.10 to remediate the input sanitization flaws.

Proactive Monitoring: Review application logs for suspicious script injection patterns or unusual administrative actions performed by standard user accounts.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict script execution and mitigate the impact of potential XSS attacks until the patch is applied.

Public Exploit Available: Unknown

Given the potential for account takeover, this vulnerability should be treated with high priority. Organizations must apply the provided updates immediately to secure their authentication workflows and protect user identities.