CVE-2026-53513 better-auth CVE debrief

Who should care

Users of Better Auth Authentication and Authorization Library for TypeScript, especially those using the @better-auth/sso plugin, should be aware of this vulnerability and take immediate action to protect their systems. System administrators, security teams, and developers who have integrated Better Auth into their applications are advised to review their configurations and update to the latest version.

Technical summary

The @better-auth/sso plugin in Better Auth has a vulnerability that allows for non-blind server-side request forgery and possible account linking. The issue arises from the plugin's handling of attacker-controlled URLs when skipDiscovery: true is set. This can lead to security risks, especially when trustEmailVerified: true is configured. Affected systems may be exposed to unauthorized access or account manipulation. The vulnerability is addressed in version 1.6.11, which includes fixes for the URL validation and storage issues.

Defensive priority

High

Recommended defensive actions

• Update to version 1.6.11 or later
• Review and validate oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs
• Implement additional security measures to prevent server-side request forgery
• Monitor systems for suspicious activity
• Review authentication and authorization configurations
• Verify system logs for potential security incidents
• Conduct a thorough security audit of affected systems

Evidence notes

The CVE record was published on 2026-07-15T18:16:47.547Z and was last modified on 2026-07-21T15:39:52.240Z. The NVD entry is currently Analyzed. The @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set. These URLs are stored on the ssoProvider row without origin validation and fetched during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. The issue is fixed in version 1.6.11. Evidence limits suggest that defenders verify system configurations and review authentication logs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.