CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 15.3%

CVSS Severity

CVSS v3 Score 6.5

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6

Products affected by CVE-2026-41427

Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.10

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.10
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.11

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.11
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.12

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.12
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.13

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.13
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.14

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.14
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.15

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.15
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.16

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.16
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.17

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.17
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.18

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.18
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.19

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.19
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.20

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.20
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.21

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.21
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.22

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.22
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.8

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.8
Better-Auth » Better-Auth/oauth-Provider » Version: 1.4.9

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.4.9
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.0

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.0
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.1

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.1
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.2

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.2
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.3

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.3
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.4

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.4
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.5

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.5
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.6

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.6
Better-Auth » Better-Auth/oauth-Provider » Version: 1.5.7

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.5.7
Better-Auth » Better-Auth/oauth-Provider » Version: 1.6.0

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.6.0
Better-Auth » Better-Auth/oauth-Provider » Version: 1.6.1

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.6.1
Better-Auth » Better-Auth/oauth-Provider » Version: 1.6.2

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.6.2
Better-Auth » Better-Auth/oauth-Provider » Version: 1.6.3

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.6.3
Better-Auth » Better-Auth/oauth-Provider » Version: 1.6.4

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.6.4
Better-Auth » Better-Auth/oauth-Provider » Version: 1.7.0

cpe:2.3:a:better-auth:better-auth/oauth-provider:1.7.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41427

Products

Pricing

Contact Us