Time-of-check Time-of-use (TOCTOU) Race Condition Affecting @better-auth/sso package, versions >=1.4.8-beta.1 <1.4.8>=1.4.8 <1.6.27>=1.7.0-rc.0 <1.7.0-rc.5

@better-auth/sso is a SSO plugin for Better Auth

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition through the verifyDomain route in packages/sso/src/routes/domain-verification.ts and the domain-based assignment logic in packages/sso/src/linking/org-assignment.ts. An attacker can make DNS proof for one provider domain apply to a changed or replaced provider, or cause a social sign-in to join an organization from an unverified SSO domain claim, by updating the provider during verification or by registering an arbitrary domain claim. In the first case, the attacker can mark a provider as domain-verified without proving control of the current domain, enabling account linking or organization assignment based on stale trust; in the second, a user signing in with a matching email domain is added to the attacker-controlled organization with the default member role even though the provider’s domain was never verified.

Workarounds

• Prevent untrusted users from registering, updating, or verifying SSO providers by enforcing an application-owned authorization gate before /sso/register, /sso/update-provider, and /sso/verify-domain; this blocks provider owners from establishing or reusing untrusted domain claims.
• Set account.accountLinking.disableImplicitLinking: true to block the account-takeover path from stale or attacker-controlled SSO domain verification.
• Set organizationProvisioning.disabled: true to block automatic organization assignment from claimed email domains.
• Audit existing provider records, remove untrusted domain claims, and revalidate every domain before trusting an existing domainVerified value; this prevents stale verification state from being treated as proof of current domain ownership.

• GitHub Commit v1.6.27
• Maintainer's Advisory