The @better-auth/sso npm package versions prior to 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling. Attackers can exploit these flaws to sign in as arbitrary users and perform account takeover. The vulnerabilities include domain verification parsing mismatches, orphaned provider account abuse, unbound SAML assertion exploitation, and reflected XSS on logout endpoints. Each of these attack vectors can independently result in unauthorized session access. The issue affects applications relying on the SSO plugin for authentication delegation. A fix is available in version 1.6.21 and users are strongly advised to upgrade immediately.