CVE-2026-53513

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in Better Auth SSO Plugin

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-53513

EUVD

EUVD-2026-44733

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better_auth	From 0.1.0 (inc) to 1.6.11 (exc)
better-auth	better-auth/sso	to 1.6.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in Better Auth's @better-auth/sso plugin allows attackers with a valid session to register or update SSO providers with malicious OIDC endpoint URLs. When skipDiscovery is true, the server accepts userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs without validating their origins. These endpoints are later fetched during OIDC callbacks, enabling server-side request forgery (SSRF) attacks where the server makes requests to internal or private hosts. If trustEmailVerified is true and email addresses overlap, attackers can also perform account takeover by injecting malicious userInfo responses.

Detection Guidance

Check if your Better Auth SSO plugin version is below 1.6.11. Inspect logs for requests to /sso/register or /sso/update-provider endpoints with suspicious OIDC endpoint URLs. Monitor outbound HTTP requests from your server to internal or private addresses.

Impact Analysis

This vulnerability can lead to SSRF attacks, allowing attackers to access internal services, read sensitive data, or interact with cloud metadata endpoints like 169.254.169.254. If trustEmailVerified is enabled and email overlaps exist, attackers may escalate to account takeover by injecting malicious userInfo responses with emailVerified set to true.

Compliance Impact

This vulnerability could violate compliance requirements by exposing internal systems to unauthorized access, potentially leading to data breaches. GDPR and HIPAA require protecting personal and health data, and SSRF risks may result in unauthorized data exposure or system access, triggering regulatory penalties.

Mitigation Strategies

Upgrade to Better Auth version 1.6.11 or later. Disable provider self-registration if not needed. Restrict access to /sso/register and /sso/update-provider endpoints. Configure trustedOrigins allowlist for internal IdPs. Implement network-level egress controls to block outbound requests to private addresses.

Hi! I’m here to help you understand CVE-2026-53513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70