CVE-2026-53513

Summary

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

Affected Software

VendorProductVersion RangeStatus
better-authbetter-auth>= 0.1.0, < 1.6.11affected
@better-authsso>= 0.1.0, < 1.6.11affected

Weaknesses

  • CWE-20: CWE-20: Improper Input Validation
  • CWE-345: CWE-345: Insufficient Verification of Data Authenticity
  • CWE-441: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
  • CWE-918: CWE-918: Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References