PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53513 better-auth CVE debrief

The CVE-2026-53513 issue was identified in Better Auth, an authentication and authorization library for TypeScript. The @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints were found to be vulnerable. When skipDiscovery: true is set, these endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs, store them without origin validation, and fetch them during OIDC callback. This allows for non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. The issue is fixed in version 1.6.11. This vulnerability has a high impact on system security, especially in environments where trustEmailVerified: true is configured.

Vendor
better-auth
Product
Unknown
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-15
Original CVE updated
2026-07-21
Advisory published
2026-07-15
Advisory updated
2026-07-21

Who should care

Users of Better Auth Authentication and Authorization Library for TypeScript, especially those using the @better-auth/sso plugin, should be aware of this vulnerability and take immediate action to protect their systems. System administrators, security teams, and developers who have integrated Better Auth into their applications are advised to review their configurations and update to the latest version.

Technical summary

The @better-auth/sso plugin in Better Auth has a vulnerability that allows for non-blind server-side request forgery and possible account linking. The issue arises from the plugin's handling of attacker-controlled URLs when skipDiscovery: true is set. This can lead to security risks, especially when trustEmailVerified: true is configured. Affected systems may be exposed to unauthorized access or account manipulation. The vulnerability is addressed in version 1.6.11, which includes fixes for the URL validation and storage issues.

Defensive priority

High

Recommended defensive actions

  • Update to version 1.6.11 or later
  • Review and validate oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs
  • Implement additional security measures to prevent server-side request forgery
  • Monitor systems for suspicious activity
  • Review authentication and authorization configurations
  • Verify system logs for potential security incidents
  • Conduct a thorough security audit of affected systems

Evidence notes

The CVE record was published on 2026-07-15T18:16:47.547Z and was last modified on 2026-07-21T15:39:52.240Z. The NVD entry is currently Analyzed. The @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set. These URLs are stored on the ssoProvider row without origin validation and fetched during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. The issue is fixed in version 1.6.11. Evidence limits suggest that defenders verify system configurations and review authentication logs.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-15T18:16:47.547Z and has not been modified since then. The NVD entry is currently Analyzed.