CVE-2026-53515
7.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Exploitability: 2.8 / Impact: 4.2
Source: security-advisories@github.com (Secondary)
Description
Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
Affected (2)
Products: Better Auth: Better Auth/sso, Better Auth
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.6.11 | |
| From 1.2.10 to 1.6.11 |
Related CWEs
CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References (4)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
MitigationVendor Advisory
Timeline
No history available yet.