Better-auth/sso vulnerabilities

2 known vulnerabilities in Better-auth/sso from Better-auth. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  better-auth: Improper Privilege Management

  CVE-2026-53515Jul 15, 2026Better-auth

  Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvid

• 9.6 Critical severity

  Better Auth is an authentication and authorization library for TypeScript.

  CVE-2026-53513Jul 15, 2026Better-auth

  Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwks