Executive brief
Better Auth is an authentication library for TypeScript applications. A security flaw in its OAuth provider component allowed any logged-in user to register their own OAuth clients, even when administrators had configured restrictions to prevent this. This could allow an attacker to create malicious applications that appear legitimate to other users, potentially leading to phishing attacks or unauthorized data access.
Technical details
An authorization bypass exists in the @better-auth/oauth-provider package due to a failure to invoke the clientPrivileges 'create' hook. While the library correctly enforces privileges for read, update, and delete operations, the /oauth2/create-client and /admin/oauth2/create-client endpoints bypass these checks before persisting new client records. An authenticated attacker can exploit this to register OAuth clients with arbitrary redirect URIs and metadata. If the admin endpoint is exposed, attackers may also write sensitive fields such as 'skip_consent'. The vulnerability is addressed in version 1.6.5 by ensuring the hook is called before persistence.
Affected products
- Better Auth @better-auth/oauth-provider >= 1.4.8-beta.7, < 1.6.5; >= 1.7.0-beta.0, <= 1.7.0-beta.1
Timeline
- 2026-04-16: advisory: GitHub Security Advisory published
- 2026-04-24: disclosed: CVE published to NVD
- 2026-04-24: patched: Fix released in version 1.6.5