better-auth Better Auth up to 1.6.10 SSO Plugin sso/register registerSSOProvider providerId improper authorization

Summaryinfo

A vulnerability labeled as critical has been found in better-auth Better Auth up to 1.6.10. This affects the function registerSSOProvider of the file sso/register of the component SSO Plugin. Executing a manipulation of the argument providerId can lead to improper authorization. The identification of this vulnerability is CVE-2026-53515. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in better-auth Better Auth up to 1.6.10 and classified as critical. This vulnerability affects the function registerSSOProvider of the file sso/register of the component SSO Plugin. The manipulation of the argument providerId with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.

The advisory is available at github.com. This vulnerability was named CVE-2026-53515 since 06/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 1.6.11 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• better-auth

Name

• Better Auth

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion