@better-auth/sso has 1 advisory. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 1.7.3
- Advisories
- 1 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(1)
Source summary
Am I affected? You may be affected if you use @better-auth/sso 1.7.0-rc.2 through 1.7.0-rc.6 or 1.7.0 through 1.7.2 , and all of these conditions hold: - An attacker can register a personal SSO provider or use one they registered earlier. Registration is enabled by default for signed-in users, with a limit of 10 providers each. - Your application has not configured resolveUser . - A victim's account is linked through another OpenID Connect (OIDC) or SAML provider, and the attacker can reproduce that provider's identity and the victim's account identifier. Configuring resolveUser requires an ex
- Affected
- @better-auth/sso >=1.7.0-rc.2 <1.7.0 · @better-auth/sso >=1.7.0 <1.7.3
- Fixed in
- 1.7.3
- ID
- GHSA-mx9r-x6ww-qjw9