2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
better-auth-sso
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting better-auth-sso, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-gv74-j8m3-fg5f | High | @better-auth/sso: SSO provider may allow registration for any org member without a checking their role### Am I affected? You are affected if all of the following are true: - You depend on `@better-auth/sso` at any version in `>= 1.2.10, < 1.6.11`, or any current `next` pre-release. - You enable both `sso()` and `organization()` plugins. - `providersLimit` is at its default (`10`) or any non-zero value, so SSO provider registration is enabled for authenticated users. - An organization has non-admin members, or your application can add users to organizations as regular members. You are at the highest risk if any of these also hold: - Organization membership can be obtained without a direct a |
| GitHub (opens in a new tab) | |
| GHSA-5rr4-8452-hf4v | Critical | @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints### Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at a version `>= 0.1.0, < 1.6.11` on the stable line, or any `1.7.0-beta.x` on the pre-release line. - The `sso()` plugin is added to their application's `betterAuth({ plugins: [...] })` array. - Any user with a valid Better Auth session can reach `POST /sso/register` (the plugin's default gate accepts any session). For the non-blind SSRF impact (full IAM credential or internal HTTP body exfiltration), no further configuration is required. For the account takeover escalation, |
| GitHub (opens in a new tab) |
- GHSA-gv74-j8m3-fg5fHigh@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
>= 1.2.10, < 1.6.11
### Am I affected? You are affected if all of the following are true: - You depend on `@better-auth/sso` at any version in `>= 1.2.10, < 1.6.11`, or any current `next` pre-release. - You enable both `sso()` and `organization()` plugins. - `providersLimit` is at its default (`10`) or any non-zero value, so SSO provider registration is enabled for authenticated users. - An organization has non-admin members, or your application can add users to organizations as regular members. You are at the highest risk if any of these also hold: - Organization membership can be obtained without a direct a
CVE: CVE-2026-53515
- GHSA-5rr4-8452-hf4vCritical@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
>= 0.1.0, < 1.6.11
### Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at a version `>= 0.1.0, < 1.6.11` on the stable line, or any `1.7.0-beta.x` on the pre-release line. - The `sso()` plugin is added to their application's `betterAuth({ plugins: [...] })` array. - Any user with a valid Better Auth session can reach `POST /sso/register` (the plugin's default gate accepts any session). For the non-blind SSRF impact (full IAM credential or internal HTTP body exfiltration), no further configuration is required. For the account takeover escalation,
CVE: CVE-2026-53513