CVE-2026-53515
CVE-2026-53515 · Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
CVSS 7.1 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
better-auth
- Versiones
- >= 1.2.10, < 1.6.11: Afectada
Sin corrección publicada
sso
- Versiones
- >= 1.2.10, < 1.6.11: Afectada
Sin corrección publicada
@better-auth/sso npm
- Intervalos de versiones afectados
- SEMVER: ≥ 1.2.10, < 1.6.11
Actualiza a 1.6.11
Fuentes originales
- https://github.com/better-auth/better-auth/security/advisories/GHSA-gv74-j8m3-fg5f
- https://github.com/better-auth/better-auth/pull/9220
- https://github.com/better-auth/better-auth/commit/86765f1597378f5c3deed1b80ca91faac0a6bf00
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11
- https://nvd.nist.gov/vuln/detail/CVE-2026-53515