CVE-2026-53513: Better Auth SSRF and account takeover in @better-auth/sso plugin

CVE-2026-53513 · Severity: critical · CVSS 9.6 · Published 2026-07-15

The @better-auth/sso library is an authentication plugin that allows applications to integrate single sign-on via OpenID Connect. The SSO provider registration endpoints accept user-controlled OIDC endpoint URLs without validating their origin, allowing an authenticated attacker to redirect server-side HTTP requests to internal resources (including cloud metadata services, internal APIs, and local infrastructure). If the application is configured with trustEmailVerified enabled, this can escalate to account takeover by forging email verification claims.

Technologies: Better-Auth SSO. Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-53513 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53513 being exploited in the wild.
How severe is CVE-2026-53513?
Critical severity, with a CVSS score of 9.6, published 15 July 2026.
Which products and versions are affected?
Better-Auth SSO >= 0.1.0, < 1.6.11; @better-auth/sso (npm) >= 0.1.0, < 1.6.11, SEMVER:introduced=0.1.0,fixed=1.6.11.
Is there a fix for CVE-2026-53513?
Yes. @better-auth/sso (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53513 attacked?
It is attacked over the network.
Am I affected by CVE-2026-53513?
Check whether you run Better-Auth SSO or @better-auth/sso (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @better-auth/sso (npm): upgrade to 1.6.11 or later
    npm install @better-auth/sso@1.6.11

Technical details

The vulnerability is an improper input validation (CWE-20) and insufficient data authenticity verification (CWE-345) flaw in the @better-auth/sso OpenID Connect provider registration flow. The vulnerable endpoints (POST /sso/register with skipDiscovery: true, and POST /sso/update-provider) accept bare string inputs for OIDC endpoint URLs (authorizationEndpoint, tokenEndpoint, userInfoEndpoint, jwksEndpoint, discoveryEndpoint) without URL validation or origin gating. These URLs are persisted to the ssoProvider database row as-is. During OIDC callback processing, the stored URLs are dereferenced server-side by validateAuthorizationCode (token endpoint), betterFetch (userInfo endpoint), and validateToken (JWKS endpoint), allowing an attacker to exfiltrate response bodies from any HTTP endpoint reachable from the auth server—including RFC 1918 private ranges, cloud metadata services (AWS IMDS, GCP metadata), and localhost infrastructure. Exploitation requires a valid Better Auth session (low privilege); the default plugin gate accepts any authenticated user. The non-blind SSRF impact (credential and body exfiltration) is reachable immediately. Account takeover escalation requires the application to set trustEmailVerified: true and have pre-existing user accounts whose email addresses overlap with attacker-chosen domains; the attacker injects emailVerified: true into a malicious userInfo response to trigger OAuth auto-linking. The patch (v1.6.11) adds origin validation at registration and update time, rejecting URLs unless they are publicly routable or listed in the application's trustedOrigins configuration, and tightens schema validation from z.string() to z.url().

Affected products

  • @better-auth @better-auth/sso >=0.1.0, <1.6.11

Identifiers

  • CVE-2026-53513
  • GHSA-5rr4-8452-hf4v

Timeline

  • 2026-05-31: disclosed: Advisory published
  • 2026-05-12: patched: Fix committed to main branch
  • 2026-07-07: advisory: GHSA-5rr4-8452-hf4v published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.