Oauth Provider
Monthly
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, plus 1.7.0-beta.0/1.7.0-beta.1) lets any authenticated user register OAuth clients even when the clientPrivileges option was configured to gate the create action. The OAuth client creation endpoints (/oauth2/create-client and /admin/oauth2/create-client) never invoked the clientPrivileges hook before persisting new records, so restrictions on client registration were silently ineffective. Publicly available exploit code exists; EPSS is low (0.05%) and SSVC lists no observed exploitation, indicating limited real-world weaponization to date.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, plus 1.7.0-beta.0/1.7.0-beta.1) lets any authenticated user register OAuth clients even when the clientPrivileges option was configured to gate the create action. The OAuth client creation endpoints (/oauth2/create-client and /admin/oauth2/create-client) never invoked the clientPrivileges hook before persisting new records, so restrictions on client registration were silently ineffective. Publicly available exploit code exists; EPSS is low (0.05%) and SSVC lists no observed exploitation, indicating limited real-world weaponization to date.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.