CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
Attackers can exploit unvalidated OIDC endpoints in Better Auth's SSO plugin to perform server-side request forgery and potentially link accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53513?
CVE-2026-53513 is a critical server-side request forgery vulnerability in @better-auth better-auth, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.
Which versions are affected by CVE-2026-53513?
2 open source packages ship an affected version, including @better-auth/sso. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@better-auth/sso npm | From 0.1.0 | 1.6.11 |
@better-auth/sso npm | From 0.1.0 | 1.6.11 |
Products include Better-Auth Better-Auth\/Sso, Better-Auth Better Auth.
How do I fix CVE-2026-53513?
Upgrade @better-auth/sso to 1.6.11 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-53513 being exploited?
There is no known exploitation of CVE-2026-53513 in the wild and no public exploit code.
Other vulnerabilities in @better-auth better-auth
Sources
Also known as GHSA-5rr4-8452-hf4v.