CVE-2026-53513
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.
How to fix
- better-auth better_auth1.6.11 or later
- better-auth better-auth\/sso1.6.11 or later
- @better-auth/sso1.6.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| better-auth better_auth | 0.1.0 ≤ v < 1.6.11 | 1.6.11 |
| better-auth better-auth\/sso | v < 1.6.11 | 1.6.11 |
| @better-auth/ssonpm | 0.1.0 ≤ v < 1.6.11 | 1.6.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.