CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:better-auth:better-auth\/oauth-provider::::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:-::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:beta7::::node.js::*
	cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.7.0:beta0::::node.js::*

History

No history.

Information

Published : 2026-04-24 20:16

Updated : 2026-06-17 10:46

NVD link : CVE-2026-41427

Mitre link : CVE-2026-41427

CVE.ORG link : CVE-2026-41427

JSON object : View

Products Affected

better-auth

better-auth\/oauth-provider

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-41427", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41427", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:42:15.023332Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "better-auth", "product": "better-auth", "versions": [{"status": "affected", "version": ">= 1.4.8-beta.7, < 1.6.5"}, {"status": "affected", "version": ">= 1.7.0-beta.0, <= 1.7.0-beta.1"}]}, {"vendor": "better-auth", "product": "oauth-provider", "versions": [{"status": "affected", "version": ">= 1.4.8-beta.7, < 1.6.5"}, {"status": "affected", "version": ">= 1.7.0-beta.0, <= 1.7.0-beta.1"}]}]}], "published": "2026-04-24T20:16:27.390", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted \u2014 any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5."}], "lastModified": "2026-06-17T10:46:42.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CE35ECEB-5E33-41B9-B2D1-E45759AF936E", "versionEndExcluding": "1.6.5", "versionStartIncluding": "1.4.9"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.4.8:-:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6DA5C22B-C161-46D4-945E-3041EFA2376C"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.4.8:beta7:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "823F67C9-1A4F-4491-B4F1-CE9BB49BA6EC"}, {"criteria": "cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.7.0:beta0:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "69DC1E8F-2C5D-4D63-A054-B26028655FD2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}