CVE-2026-41427: Better Auth OAuth Provider authorization bypass in client creation

CVE-2026-41427 · Severity: high · CVSS 6.5 · Published 2026-04-24

Better Auth is an authentication library for TypeScript applications. A security flaw in its OAuth provider component allowed any logged-in user to register their own OAuth clients, even when administrators had configured restrictions to prevent this. This could allow an attacker to create malicious applications that appear legitimate to other users, potentially leading to phishing attacks or unauthorized data access.

Technologies: Better-Auth Oauth-Provider, @better-auth/oauth-provider (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-41427 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41427 being exploited in the wild.
How severe is CVE-2026-41427?
High severity, with a CVSS score of 6.5, published 24 April 2026.
Which products and versions are affected?
Better-Auth Oauth-Provider >= 1.4.8-beta.7, < 1.6.5; >= 1.7.0-beta.0, <= 1.7.0-beta.1; @better-auth/oauth-provider (npm) SEMVER:introduced=1.4.8-beta.7,fixed=1.6.5.
Is there a fix for CVE-2026-41427?
Yes. @better-auth/oauth-provider (npm): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41427 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41427?
Check whether you run Better-Auth Oauth-Provider or @better-auth/oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @better-auth/oauth-provider (npm): upgrade to 1.6.5 or later
    npm install @better-auth/oauth-provider@1.6.5

Technical details

An authorization bypass exists in the @better-auth/oauth-provider package due to a failure to invoke the clientPrivileges 'create' hook. While the library correctly enforces privileges for read, update, and delete operations, the /oauth2/create-client and /admin/oauth2/create-client endpoints bypass these checks before persisting new client records. An authenticated attacker can exploit this to register OAuth clients with arbitrary redirect URIs and metadata. If the admin endpoint is exposed, attackers may also write sensitive fields such as 'skip_consent'. The vulnerability is addressed in version 1.6.5 by ensuring the hook is called before persistence.

Affected products

  • Better Auth @better-auth/oauth-provider >= 1.4.8-beta.7, < 1.6.5; >= 1.7.0-beta.0, <= 1.7.0-beta.1

Identifiers

  • CVE-2026-41427
  • GHSA-xr8f-h2gw-9xh6

Timeline

  • 2026-04-16: advisory: GitHub Security Advisory published
  • 2026-04-24: disclosed: CVE published to NVD
  • 2026-04-24: patched: Fix released in version 1.6.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.