Junglewise Threat Intelligence

CVE-2026-53513: Better Auth SSRF and account takeover in @better-auth/sso plugin

CVE-2026-53513 · Severity: critical · CVSS 9.6 · Published 2026-07-15

Technologies: Better-Auth SSO. Vendors: npm, Better-Auth.

Executive brief

The @better-auth/sso library is an authentication plugin that allows applications to integrate single sign-on via OpenID Connect. The SSO provider registration endpoints accept user-controlled OIDC endpoint URLs without validating their origin, allowing an authenticated attacker to redirect server-side HTTP requests to internal resources (including cloud metadata services, internal APIs, and local infrastructure). If the application is configured with trustEmailVerified enabled, this can escalate to account takeover by forging email verification claims.

Technical details

The vulnerability is an improper input validation (CWE-20) and insufficient data authenticity verification (CWE-345) flaw in the @better-auth/sso OpenID Connect provider registration flow. The vulnerable endpoints (POST /sso/register with skipDiscovery: true, and POST /sso/update-provider) accept bare string inputs for OIDC endpoint URLs (authorizationEndpoint, tokenEndpoint, userInfoEndpoint, jwksEndpoint, discoveryEndpoint) without URL validation or origin gating. These URLs are persisted to the ssoProvider database row as-is. During OIDC callback processing, the stored URLs are dereferenced server-side by validateAuthorizationCode (token endpoint), betterFetch (userInfo endpoint), and validateToken (JWKS endpoint), allowing an attacker to exfiltrate response bodies from any HTTP endpoint reachable from the auth server—including RFC 1918 private ranges, cloud metadata services (AWS IMDS, GCP metadata), and localhost infrastructure. Exploitation requires a valid Better Auth session (low privilege); the default plugin gate accepts any authenticated user. The non-blind SSRF impact (credential and body exfiltration) is reachable immediately. Account takeover escalation requires the application to set trustEmailVerified: true and have pre-existing user accounts whose email addresses overlap with attacker-chosen domains; the attacker injects emailVerified: true into a malicious userInfo response to trigger OAuth auto-linking. The patch (v1.6.11) adds origin validation at registration and update time, rejecting URLs unless they are publicly routable or listed in the application's trustedOrigins configuration, and tightens schema validation from z.string() to z.url().

Affected products

  • @better-auth @better-auth/sso >=0.1.0, <1.6.11

Timeline

  • 2026-05-31: disclosed: Advisory published
  • 2026-05-12: patched: Fix committed to main branch
  • 2026-07-07: advisory: GHSA-5rr4-8452-hf4v published

References

Related threats