Skip to content
OpenAdvisories

Package · npm

@better-auth/sso

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-53513

    Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwk…

    better-auth better-auth sso @better-auth/sso npm