CVE-2026-53515

Katalog CVE

CVSS 7.1 · High EPSS 0,43%

Kerentanan Improper Privilege Management pada better-auth/sso, better-auth better auth. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-gv74-j8m3-fg5f mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/86765f1597378f5c3deed1b80ca91faac0a6bf00 patch
• https://github.com/better-auth/better-auth/pull/9220 issue tracking · patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes