Skip to content
OpenAdvisories

Package · npm

@better-auth/sso

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.1
    CVE-2026-53515

    Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso

    Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvi…

    better-auth better-auth sso @better-auth/sso npm
  • Critical 9.6
    CVE-2026-53513

    Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwk…

    better-auth better-auth sso @better-auth/sso npm