Back to overview

CVE-2026-53513

CRITICAL
9.6
CVSS 3.1
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

Metadata

CVE ID
CVE-2026-53513
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-09 17:30 UTC
Published
2026-07-15 17:15 UTC
Last updated
2026-07-15 19:29 UTC
Primary CWE
CWE-20
CWE-20: Improper Input Validation
Vendor / Product
better-auth / better-auth
Sources
cve.org  ·  NVD

Severity & Metrics

9.6 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
@better-auth sso — >= 0.1.0, < 1.6.11
better-auth better-auth — >= 0.1.0, < 1.6.11
Weakness (CWE)
CWESourceDescription
CWE-20 cna CWE-20: Improper Input Validation
CWE-345 cna CWE-345: Insufficient Verification of Data Authenticity
CWE-441 cna CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 cna CWE-918: Server-Side Request Forgery (SSRF)
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.6 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References (4)
Back to overview