Am I affected? You may be affected if you use @better-auth/sso 1.7.0-rc.2 through 1.7.0-rc.6 or 1.7.0 through 1.7.2 , and all of these conditions hold: - An attacker can register a personal SSO provider or use one they registered earlier. Registration is enabled by default for signed-in users, with a limit of 10 providers each. - Your application has not configured resolveUser . - A victim's account is linked through another OpenID Connect (OIDC) or SAML provider, and the attacker can reproduce that provider's identity and the victim's account identifier. Configuring resolveUser requires an ex