CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-53515

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 15.4%

CVSS Severity

CVSS v3 Score 7.1

References

Products affected by CVE-2026-53515

Better-Auth » Better-Auth/sso » Version: 1.3.0

cpe:2.3:a:better-auth:better-auth/sso:1.3.0
Better-Auth » Better-Auth/sso » Version: 1.3.1

cpe:2.3:a:better-auth:better-auth/sso:1.3.1
Better-Auth » Better-Auth/sso » Version: 1.3.10

cpe:2.3:a:better-auth:better-auth/sso:1.3.10
Better-Auth » Better-Auth/sso » Version: 1.3.11

cpe:2.3:a:better-auth:better-auth/sso:1.3.11
Better-Auth » Better-Auth/sso » Version: 1.3.12

cpe:2.3:a:better-auth:better-auth/sso:1.3.12
Better-Auth » Better-Auth/sso » Version: 1.3.13

cpe:2.3:a:better-auth:better-auth/sso:1.3.13
Better-Auth » Better-Auth/sso » Version: 1.3.14

cpe:2.3:a:better-auth:better-auth/sso:1.3.14
Better-Auth » Better-Auth/sso » Version: 1.3.15

cpe:2.3:a:better-auth:better-auth/sso:1.3.15
Better-Auth » Better-Auth/sso » Version: 1.3.16

cpe:2.3:a:better-auth:better-auth/sso:1.3.16
Better-Auth » Better-Auth/sso » Version: 1.3.17

cpe:2.3:a:better-auth:better-auth/sso:1.3.17
Better-Auth » Better-Auth/sso » Version: 1.3.18

cpe:2.3:a:better-auth:better-auth/sso:1.3.18
Better-Auth » Better-Auth/sso » Version: 1.3.2

cpe:2.3:a:better-auth:better-auth/sso:1.3.2
Better-Auth » Better-Auth/sso » Version: 1.3.22

cpe:2.3:a:better-auth:better-auth/sso:1.3.22
Better-Auth » Better-Auth/sso » Version: 1.3.23

cpe:2.3:a:better-auth:better-auth/sso:1.3.23
Better-Auth » Better-Auth/sso » Version: 1.3.24

cpe:2.3:a:better-auth:better-auth/sso:1.3.24
Better-Auth » Better-Auth/sso » Version: 1.3.25

cpe:2.3:a:better-auth:better-auth/sso:1.3.25
Better-Auth » Better-Auth/sso » Version: 1.3.26

cpe:2.3:a:better-auth:better-auth/sso:1.3.26
Better-Auth » Better-Auth/sso » Version: 1.3.27

cpe:2.3:a:better-auth:better-auth/sso:1.3.27
Better-Auth » Better-Auth/sso » Version: 1.3.28

cpe:2.3:a:better-auth:better-auth/sso:1.3.28
Better-Auth » Better-Auth/sso » Version: 1.3.29

cpe:2.3:a:better-auth:better-auth/sso:1.3.29
Better-Auth » Better-Auth/sso » Version: 1.3.3

cpe:2.3:a:better-auth:better-auth/sso:1.3.3
Better-Auth » Better-Auth/sso » Version: 1.3.30

cpe:2.3:a:better-auth:better-auth/sso:1.3.30
Better-Auth » Better-Auth/sso » Version: 1.3.31

cpe:2.3:a:better-auth:better-auth/sso:1.3.31
Better-Auth » Better-Auth/sso » Version: 1.3.32

cpe:2.3:a:better-auth:better-auth/sso:1.3.32
Better-Auth » Better-Auth/sso » Version: 1.3.33

cpe:2.3:a:better-auth:better-auth/sso:1.3.33
Better-Auth » Better-Auth/sso » Version: 1.3.34

cpe:2.3:a:better-auth:better-auth/sso:1.3.34
Better-Auth » Better-Auth/sso » Version: 1.3.4

cpe:2.3:a:better-auth:better-auth/sso:1.3.4
Better-Auth » Better-Auth/sso » Version: 1.3.5

cpe:2.3:a:better-auth:better-auth/sso:1.3.5
Better-Auth » Better-Auth/sso » Version: 1.3.6

cpe:2.3:a:better-auth:better-auth/sso:1.3.6
Better-Auth » Better-Auth/sso » Version: 1.3.7

cpe:2.3:a:better-auth:better-auth/sso:1.3.7
Better-Auth » Better-Auth/sso » Version: 1.3.8

cpe:2.3:a:better-auth:better-auth/sso:1.3.8
Better-Auth » Better-Auth/sso » Version: 1.3.9

cpe:2.3:a:better-auth:better-auth/sso:1.3.9
Better-Auth » Better-Auth/sso » Version: 1.4.0

cpe:2.3:a:better-auth:better-auth/sso:1.4.0
Better-Auth » Better-Auth/sso » Version: 1.4.1

cpe:2.3:a:better-auth:better-auth/sso:1.4.1
Better-Auth » Better-Auth/sso » Version: 1.4.10

cpe:2.3:a:better-auth:better-auth/sso:1.4.10
Better-Auth » Better-Auth/sso » Version: 1.4.11

cpe:2.3:a:better-auth:better-auth/sso:1.4.11
Better-Auth » Better-Auth/sso » Version: 1.4.12

cpe:2.3:a:better-auth:better-auth/sso:1.4.12
Better-Auth » Better-Auth/sso » Version: 1.4.13

cpe:2.3:a:better-auth:better-auth/sso:1.4.13
Better-Auth » Better-Auth/sso » Version: 1.4.14

cpe:2.3:a:better-auth:better-auth/sso:1.4.14
Better-Auth » Better-Auth/sso » Version: 1.4.15

cpe:2.3:a:better-auth:better-auth/sso:1.4.15
Better-Auth » Better-Auth/sso » Version: 1.4.16

cpe:2.3:a:better-auth:better-auth/sso:1.4.16
Better-Auth » Better-Auth/sso » Version: 1.4.17

cpe:2.3:a:better-auth:better-auth/sso:1.4.17
Better-Auth » Better-Auth/sso » Version: 1.4.18

cpe:2.3:a:better-auth:better-auth/sso:1.4.18
Better-Auth » Better-Auth/sso » Version: 1.4.19

cpe:2.3:a:better-auth:better-auth/sso:1.4.19
Better-Auth » Better-Auth/sso » Version: 1.4.2

cpe:2.3:a:better-auth:better-auth/sso:1.4.2
Better-Auth » Better-Auth/sso » Version: 1.4.20

cpe:2.3:a:better-auth:better-auth/sso:1.4.20
Better-Auth » Better-Auth/sso » Version: 1.4.21

cpe:2.3:a:better-auth:better-auth/sso:1.4.21
Better-Auth » Better-Auth/sso » Version: 1.4.22

cpe:2.3:a:better-auth:better-auth/sso:1.4.22
Better-Auth » Better-Auth/sso » Version: 1.4.3

cpe:2.3:a:better-auth:better-auth/sso:1.4.3
Better-Auth » Better-Auth/sso » Version: 1.4.4

cpe:2.3:a:better-auth:better-auth/sso:1.4.4
Better-Auth » Better-Auth/sso » Version: 1.4.5

cpe:2.3:a:better-auth:better-auth/sso:1.4.5
Better-Auth » Better-Auth/sso » Version: 1.4.6

cpe:2.3:a:better-auth:better-auth/sso:1.4.6
Better-Auth » Better-Auth/sso » Version: 1.4.7

cpe:2.3:a:better-auth:better-auth/sso:1.4.7
Better-Auth » Better-Auth/sso » Version: 1.4.8

cpe:2.3:a:better-auth:better-auth/sso:1.4.8
Better-Auth » Better-Auth/sso » Version: 1.4.9

cpe:2.3:a:better-auth:better-auth/sso:1.4.9
Better-Auth » Better-Auth/sso » Version: 1.5.0

cpe:2.3:a:better-auth:better-auth/sso:1.5.0
Better-Auth » Better-Auth/sso » Version: 1.5.1

cpe:2.3:a:better-auth:better-auth/sso:1.5.1
Better-Auth » Better-Auth/sso » Version: 1.5.2

cpe:2.3:a:better-auth:better-auth/sso:1.5.2
Better-Auth » Better-Auth/sso » Version: 1.5.3

cpe:2.3:a:better-auth:better-auth/sso:1.5.3
Better-Auth » Better-Auth/sso » Version: 1.5.4

cpe:2.3:a:better-auth:better-auth/sso:1.5.4
Better-Auth » Better-Auth/sso » Version: 1.5.5

cpe:2.3:a:better-auth:better-auth/sso:1.5.5
Better-Auth » Better-Auth/sso » Version: 1.5.6

cpe:2.3:a:better-auth:better-auth/sso:1.5.6
Better-Auth » Better-Auth/sso » Version: 1.5.7

cpe:2.3:a:better-auth:better-auth/sso:1.5.7
Better-Auth » Better-Auth/sso » Version: 1.6.0

cpe:2.3:a:better-auth:better-auth/sso:1.6.0
Better-Auth » Better-Auth/sso » Version: 1.6.0beta.0

cpe:2.3:a:better-auth:better-auth/sso:1.6.0beta.0
Better-Auth » Better-Auth/sso » Version: 1.6.1

cpe:2.3:a:better-auth:better-auth/sso:1.6.1
Better-Auth » Better-Auth/sso » Version: 1.6.10

cpe:2.3:a:better-auth:better-auth/sso:1.6.10
Better-Auth » Better-Auth/sso » Version: 1.6.2

cpe:2.3:a:better-auth:better-auth/sso:1.6.2
Better-Auth » Better-Auth/sso » Version: 1.6.3

cpe:2.3:a:better-auth:better-auth/sso:1.6.3
Better-Auth » Better-Auth/sso » Version: 1.6.4

cpe:2.3:a:better-auth:better-auth/sso:1.6.4
Better-Auth » Better-Auth/sso » Version: 1.6.5

cpe:2.3:a:better-auth:better-auth/sso:1.6.5
Better-Auth » Better-Auth/sso » Version: 1.6.6

cpe:2.3:a:better-auth:better-auth/sso:1.6.6
Better-Auth » Better-Auth/sso » Version: 1.6.7

cpe:2.3:a:better-auth:better-auth/sso:1.6.7
Better-Auth » Better-Auth/sso » Version: 1.6.8

cpe:2.3:a:better-auth:better-auth/sso:1.6.8
Better-Auth » Better-Auth/sso » Version: 1.6.9

cpe:2.3:a:better-auth:better-auth/sso:1.6.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-53515

Products

Pricing

Contact Us