EUVD-2026-44740
GHSA-gv74-j8m3-fg5f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network endpoint reachable by any authenticated org member (PR:L), no UI or added complexity; registering a rogue provider is a high-integrity change with limited confidentiality and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
AnalysisAI
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days afte
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today