EUVD-2026-25617
GHSA-xr8f-h2gw-9xh6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable create endpoint needs only a low-privilege authenticated session (PR:L, AC:L); impact is limited integrity via unauthorized client registration (I:L), with no confidentiality or availability loss.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted - any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.
AnalysisAI
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, plus 1.7.0-beta.0/1.7.0-beta.1) lets any authenticated user register OAuth clients even when the clientPrivileges option was configured to gate the create action. The OAuth client creation endpoints (/oauth2/create-client and /admin/oauth2/create-client) never invoked the clientPrivileges hook before persisting new records, so restrictions on client registration were silently ineffective. Publicly available exploit code exists; EPSS is low (0.05%) and SSVC lists no observed exploitation, indicating limited real-world weaponization to date.
Technical ContextAI
The affected component is Better Auth's OAuth 2.1 Provider plugin (npm package @better-auth/oauth-provider), a TypeScript authentication/authorization library. The clientPrivileges option is a policy hook intended to authorize dynamic client-registration operations (create, read, list, update, delete, rotate). This is a CWE-863 (Incorrect Authorization) flaw: the hook was correctly wired into every operation except create, so the create code path persisted new client records without ever consulting the authorization callback. CPE data covers cpe:2.3:a:better-auth:better-auth and cpe:2.3:a:better-auth:oauth-provider. The abused endpoints are the standard dynamic client registration routes; the admin variant (/admin/oauth2/create-client) is SERVER_ONLY by design and additionally governs sensitive fields such as skip_consent.
RemediationAI
Vendor-released patch: @better-auth/oauth-provider 1.6.5, in which both create endpoints now invoke the clientPrivileges hook with action "create" before persisting a client - upgrade to 1.6.5 or later per GHSA-xr8f-h2gw-9xh6 (https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6). Note the 1.7.0 pre-release line (1.7.0-beta.0/1.7.0-beta.1) has no fixed release listed, so move off those betas onto a patched stable line. If you cannot upgrade immediately, block the /oauth2/create-client and /admin/oauth2/create-client routes at your reverse proxy or middleware for any user who should not register clients (trade-off: this also blocks legitimate self-service client registration and must be maintained in lockstep with your auth logic), and ensure the SERVER_ONLY /admin/oauth2/create-client endpoint is never reachable from end-user sessions since it exposes sensitive fields like skip_consent.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today