Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Better Auth SSO may fetch attacker-chosen URLs

CVE-2026-53513 · published 3 months ago
Summary

The Better Auth SSO add‑on for TypeScript applications allowed certain setup pages to accept URLs supplied by an attacker. Those URLs could be stored and later called by the server, letting a malicious site cause your system to contact outside resources and potentially misuse account linking features. Upgrade the Better Auth SSO package to version 1.6.11 or newer to stop this behavior.

What to do
  • Update better-auth sso to version 1.6.11.
  • Update better-auth better_auth to version 1.6.11 or later.
  • Update better-auth better-auth\/sso to version 1.6.11 or later.
Affected software
Ecosystem VendorProductAffected versions
npm better-auth sso >= 0.1.0, < 1.6.11
Fix: upgrade to 1.6.11
– better-auth better-auth >= 0.1.0, < 1.6.11
– @better-auth sso >= 0.1.0, < 1.6.11
– better-auth better_auth >= 0.1.0, < 1.6.11
cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*
– better-auth better-auth\/sso < 1.6.11
cpe:2.3:a:better-auth:better-auth\/sso:*:*:*:*:*:node.js:*:*
Original advisory text
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-345Insufficient Verification of Data Authenticity
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published15 Jul 2026
Updated4 Nov 2026
First seen7 Jul 2026
Sources
GHSA-5rr4-8452-hf4v · GHSA
CVE-2026-53513 · NVD
CVE-2026-53513 · MITRE
CVE-2026-53513 · OSV
Track software like this
Free during beta