p PatchFirst

CVE-2026-53513

CVE-2026-53513 · Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

CVSS 9.6 · Critical · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • better-auth

    Versions
    • >= 0.1.0, < 1.6.11: Affected

    No fix published

  • sso

    Versions
    • >= 0.1.0, < 1.6.11: Affected

    No fix published

  • @better-auth/sso npm

    Affected ranges
    • SEMVER: ≥ 0.1.0, < 1.6.11

    Update to 1.6.11

Original sources

Check your server →