CVE-2026-53513

Katalog CVE

CVSS 9.6 · Critical EPSS 0,25%

Kerentanan Improper Input Validation pada better-auth/sso, better-auth better auth. Skor CVSS 3.1 9.6 (Critical) menurut github.com.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-345: Insufficient Verification of Data Authenticity
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-5rr4-8452-hf4v mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/37f60cb176cb53147da7dfd5ec15afa5b486e81e patch
• https://github.com/better-auth/better-auth/pull/9574 issue tracking · patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes