CVE-2026-53515 Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
Attackers can register malicious SSO providers to escalate privileges and take over accounts due to missing admin role checks in the Better Auth SSO plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53515?
CVE-2026-53515 is a high-severity vulnerability in @better-auth better-auth, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
Which versions are affected by CVE-2026-53515?
2 open source packages ship an affected version, including @better-auth/sso. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@better-auth/sso npm | From 1.2.10 | 1.6.11 |
@better-auth/sso npm | From 1.2.10 | 1.6.11 |
Products include Better-Auth Better-Auth\/Sso, Better-Auth Better Auth.
How do I fix CVE-2026-53515?
Upgrade @better-auth/sso to 1.6.11 or later.
Is CVE-2026-53515 being exploited?
There is no known exploitation of CVE-2026-53515 in the wild and no public exploit code.
Other vulnerabilities in @better-auth better-auth
Sources
Also known as GHSA-gv74-j8m3-fg5f.