better-auth Better Auth up to 1.6.10 SSO Plugin /sso/register userInfoEndpoint/tokenEndpoint/jwksEndpoint input validation

Summaryinfo

A vulnerability labeled as critical has been found in better-auth Better Auth up to 1.6.10. Impacted is an unknown function of the file /sso/register of the component SSO Plugin. Such manipulation of the argument userInfoEndpoint/tokenEndpoint/jwksEndpoint leads to input validation. This vulnerability is referenced as CVE-2026-53513. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in better-auth Better Auth up to 1.6.10. It has been rated as critical. Affected by this issue is an unknown part of the file /sso/register of the component SSO Plugin. The manipulation of the argument userInfoEndpoint/tokenEndpoint/jwksEndpoint with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-53513 since 06/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.6.11 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• better-auth

Name

• Better Auth

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion