Time-of-check Time-of-use (TOCTOU) Race Condition@better-auth/sso is a SSO plugin for Better Auth
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition through the verifyDomain route in packages/sso/src/routes/domain-verification.ts and the domain-based assignment logic in packages/sso/src/linking/org-assignment.ts. An attacker can make DNS proof for one provider domain apply to a changed or replaced provider, or cause a social sign-in to join an organization from an unverified SSO domain claim, by updating the provider during verification or by registering an arbitrary domain claim. In the first case, the attacker can mark a provider as domain-verified without proving control of the current domain, enabling account linking or organization assignment based on stale trust; in the second, a user signing in with a matching email domain is added to the attacker-controlled organization with the default member role even though the provider’s domain was never verified.
Workarounds
- Prevent untrusted users from registering, updating, or verifying SSO providers by enforcing an application-owned authorization gate before
/sso/register, /sso/update-provider, and /sso/verify-domain; this blocks provider owners from establishing or reusing untrusted domain claims.
- Set
account.accountLinking.disableImplicitLinking: true to block the account-takeover path from stale or attacker-controlled SSO domain verification.
- Set
organizationProvisioning.disabled: true to block automatic organization assignment from claimed email domains.
- Audit existing provider records, remove untrusted domain claims, and revalidate every domain before trusting an existing
domainVerified value; this prevents stale verification state from being treated as proof of current domain ownership.
How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade @better-auth/sso to version 1.4.8, 1.6.27, 1.7.0-rc.5 or higher.
| >=1.4.8-beta.1 <1.4.8>=1.4.8 <1.6.27>=1.7.0-rc.0 <1.7.0-rc.5 |
