Better Auth EUVD-2026-25617

Requires an authenticated (but low-privilege) user session (PR:L) that can reach the /oauth2/create-client or /admin/oauth2/create-client endpoint over the network. The bug only has security impact when the deployment has configured the clientPrivileges option expecting it to gate the create action - if clientPrivileges is not configured, there is no security consequence. Exploitation is limited to the create operation only (read, list, update, delete, and rotate correctly enforced the hook), and escalation to sensitive fields such as skip_consent additionally requires the separate misconfiguration of exposing the SERVER_ONLY admin creation endpoint to end-user sessions. Affected versions are @better-auth/oauth-provider >= 1.4.8-beta.7 and < 1.6.5 plus 1.7.0-beta.0/1.7.0-beta.1.

Signals are mixed and point to a real but non-critical, targeted risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H/SI:L, score 7.1) shows network-reachable, low-complexity exploitation requiring only low privileges (an authenticated account) with a primarily integrity impact and no confidentiality or availability loss. EPSS is very low (0.05%, 15th percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - consistent with a bug that requires a valid authenticated session and a specific configuration rather than mass, unauthenticated scanning. Publicly available POC code exists, but that is distinct from active exploitation, and there is no CISA KEV listing. A key scoping nuance: this issue only has security consequence for deployments that actually configured clientPrivileges expecting it to restrict client creation; deployments without clientPrivileges configured are unaffected, which narrows the true exposed population considerably.

An attacker who holds any ordinary authenticated account on a Better Auth deployment that relies on clientPrivileges to restrict registration sends a request to /oauth2/create-client and registers a new OAuth client with attacker-controlled redirect_uris and metadata. Because the client appears as a registered first-party application, the attacker then lures victims through an OAuth flow that redirects tokens or codes to their infrastructure for phishing/account takeover. A public POC gist demonstrating the endpoint bypass is available, and the low attack complexity makes reproduction straightforward for any valid user.