Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
Priority LOW 31CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed better-auth (better-auth): 1.6.5oauth-provider (better-auth): 1.6.5+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| better-auth | better-auth | 1.4.8-beta.7 to before 1.6.5; 1.7.0-beta.0 – 1.7.0-beta.1 | 1.6.5 | Patch available | CNA |
| better-auth | oauth-provider | 1.4.8-beta.7 to before 1.6.5; 1.7.0-beta.0 – 1.7.0-beta.1 | 1.6.5 | Patch available | CNA |
| — | @better-auth/oauth-provider (npm) | 1.4.8-beta.7 to before 1.6.5 | 1.6.5 | Patch available | GHSA-xr8f-h2gw-9xh6 |
| — | @better-auth/oauth-provider (npm) | 1.7.0-beta.0 – 1.7.0-beta.1 | — | No fix listed | GHSA-xr8f-h2gw-9xh6 |
- better-auth Vendorbetter-auth Affected 1.4.8-beta.7 to before 1.6.5; 1.7.0-beta.0 – 1.7.0-beta.1 Fixed in 1.6.5 Patch available CNA
- oauth-provider Vendorbetter-auth Affected 1.4.8-beta.7 to before 1.6.5; 1.7.0-beta.0 – 1.7.0-beta.1 Fixed in 1.6.5 Patch available CNA
- @better-auth/oauth-provider (npm) Vendor— Affected 1.4.8-beta.7 to before 1.6.5 Fixed in 1.6.5 Patch available GHSA-xr8f-h2gw-9xh6
- @better-auth/oauth-provider (npm) Vendor— Affected 1.7.0-beta.0 – 1.7.0-beta.1 Fixed in — No fix listed GHSA-xr8f-h2gw-9xh6
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:better-auth:better-auth\/oauth-provider:*:*:*:*:*:node.js:*:* | 1.4.9 to before 1.6.5 | Vulnerable | better-auth |
| cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:-:*:*:*:node.js:*:* | 1.4.8 | Vulnerable | better-auth |
| cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:beta7:*:*:*:node.js:*:* | 1.4.8 beta7 | Vulnerable | better-auth |
| cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.7.0:beta0:*:*:*:node.js:*:* | 1.7.0 beta0 | Vulnerable | better-auth |
- cpe:2.3:a:better-auth:better-auth\/oauth-provider:*:*:*:*:*:node.js:*:* Versions 1.4.9 to before 1.6.5 Vulnerable ·better-auth
- cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:-:*:*:*:node.js:*:* Versions 1.4.8 Vulnerable ·better-auth
- cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.4.8:beta7:*:*:*:node.js:*:* Versions 1.4.8 beta7 Vulnerable ·better-auth
- cpe:2.3:a:better-auth:better-auth\/oauth-provider:1.7.0:beta0:*:*:*:node.js:*:* Versions 1.7.0 beta0 Vulnerable ·better-auth
Remediation
- Fix · CNA better-auth (better-auth) Fixed in 1.6.5
- Fix · CNA oauth-provider (better-auth) Fixed in 1.6.5
- Fix · GHSA-xr8f-h2gw-9xh6 @better-auth/oauth-provider (npm) Fixed in 1.6.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41427
- 2026-10-03 Alias added: GHSA-xr8f-h2gw-9xh6
References
More Better-auth/oauth-provider vulnerabilities
- TI-2026-38591 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking CVSS 3.1HIGH 8.1
- TI-2026-38592 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption CVSS 4.0HIGH 7.6
Sources
- CVE-2026-41427 · CVE Program
- CVE-2026-41427 · NVD
- FIRST EPSS
- GHSA-xr8f-h2gw-9xh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences