CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:better-auth:better-auth\/oauth-provider::::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:-::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:beta7::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.7.0:beta0::::node.js::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Better Auth es una biblioteca de autenticación y autorización para TypeScript. Antes de 1.6.5, la opción clientPrivileges documenta una acción de creación, pero los puntos finales de creación de clientes OAuth no invocaban el ’hook’ antes de persistir nuevos clientes. Las implementaciones que configuraron clientPrivileges para restringir el registro de clientes no estaban realmente restringidas - cualquier usuario autenticado podía acceder a los puntos finales de creación y registrar un cliente OAuth con URIs de redirección y metadatos elegidos por el atacante. Esta vulnerabilidad está corregida en 1.6.5.

Information

Published : 2026-04-24 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41427

Mitre link : CVE-2026-41427

CVE.ORG link : CVE-2026-41427

JSON object : View

Products Affected

better-auth

better-auth\/oauth-provider

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-41427", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41427", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:42:15.023332Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "better-auth", "product": "better-auth", "versions": [{"status": "affected", "version": ">= 1.4.8-beta.7, < 1.6.5"}, {"status": "affected", "version": ">= 1.7.0-beta.0, <= 1.7.0-beta.1"}]}, {"vendor": "better-auth", "product": "oauth-provider", "versions": [{"status": "affected", "version": ">= 1.4.8-beta.7, < 1.6.5"}, {"status": "affected", "version": ">= 1.7.0-beta.0, <= 1.7.0-beta.1"}]}]}], "published": "2026-04-24T20:16:27.390", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted \u2014 any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5."}, {"lang": "es", "value": "Better Auth es una biblioteca de autenticaci\u00f3n y autorizaci\u00f3n para TypeScript. Antes de 1.6.5, la opci\u00f3n clientPrivileges documenta una acci\u00f3n de creaci\u00f3n, pero los puntos finales de creaci\u00f3n de clientes OAuth no invocaban el \u2019hook\u2019 antes de persistir nuevos clientes. Las implementaciones que configuraron clientPrivileges para restringir el registro de clientes no estaban realmente restringidas - cualquier usuario autenticado pod\u00eda acceder a los puntos finales de creaci\u00f3n y registrar un cliente OAuth con URIs de redirecci\u00f3n y metadatos elegidos por el atacante. Esta vulnerabilidad est\u00e1 corregida en 1.6.5."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CE35ECEB-5E33-41B9-B2D1-E45759AF936E", "versionEndExcluding": "1.6.5", "versionStartIncluding": "1.4.9"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.4.8:-:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6DA5C22B-C161-46D4-945E-3041EFA2376C"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.4.8:beta7:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "823F67C9-1A4F-4491-B4F1-CE9BB49BA6EC"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.7.0:beta0:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "69DC1E8F-2C5D-4D63-A054-B26028655FD2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}