CVE-2026-53516

Katalog CVE

CVSS 8.3 · High EPSS 0,29%

Kerentanan Improper Authentication pada better-auth better auth. Skor CVSS 3.1 8.3 (High) menurut github.com.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-g38m-r43w-p2q7 mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/da7e50beee849c59a2ed1ec6b3a38cc6ab9fb563 patch
• https://github.com/better-auth/better-auth/pull/9578 issue tracking · patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes