CVE-2026-53513
Better Auth is an authentication library for TypeScript. A flaw in the @better-auth/sso plugin allowed attackers to supply arbitrary OIDC endpoint URLs when skipDiscovery is true, leading to server‑side request forgery and potential account linking. The issue is fixed in version 1.6.11.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
better-auth library, specifically the @better-auth/sso plugin, versions prior to 1.6.11. Users running the library in TypeScript applications.
Real-world impact
An attacker could trick the server into contacting malicious OIDC endpoints, enabling them to hijack user accounts or link accounts to attacker-controlled identities.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network‑accessible, requires low effort, and can lead to high confidentiality impact by allowing attackers to forge requests and potentially compromise user accounts.
What to do about it
- 01Upgrade the better-auth library to version 1.6.11 or later.
- 02Restart the application to load the updated library.
NVD-referenced vendor advisory
Timeline
- Jul 15, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 21, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/better-auth/better-auth/com…patch
- github.com/better-auth/better-auth/pul…issue trackingpatch
- github.com/better-auth/better-auth/rel…release notes
- github.com/better-auth/better-auth/sec…mitigationvendor advisory