Is CVE-2026-53515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53515 being exploited in the wild.

How severe is CVE-2026-53515?

High severity, with a CVSS score of 7.1, published 15 July 2026.

Which products and versions are affected?

Better-Auth SSO >= 1.2.10, = 1.2.10, < 1.6.11, SEMVER:introduced=1.2.10,fixed=1.6.11.

Is there a fix for CVE-2026-53515?

Yes. @better-auth/sso (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53515 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53515?

Check whether you run Better-Auth SSO or @better-auth/sso (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53515: Better Auth improper authorization in SSO provider registration

Q: Is there a fix for CVE-2026-53515?

Yes. @better-auth/sso (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53515 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53515?

Check whether you run Better-Auth SSO or @better-auth/sso (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53515 · Severity: high · CVSS 7.1 · Published 2026-07-15

A vulnerability in the Better Auth SSO plugin allows regular organization members to register their own Single Sign-On (SSO) providers without administrative approval. This could allow an attacker to link a malicious identity provider to an organization, potentially leading to unauthorized account creation or administrative access within that organization. This affects applications using both the SSO and Organization plugins where user-driven registration is enabled.

Technologies: Better-Auth SSO. Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-53515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53515 being exploited in the wild.
How severe is CVE-2026-53515?: High severity, with a CVSS score of 7.1, published 15 July 2026.
Which products and versions are affected?: Better-Auth SSO >= 1.2.10, < 1.6.11; @better-auth/sso (npm) >= 1.2.10, < 1.6.11, SEMVER:introduced=1.2.10,fixed=1.6.11.
Is there a fix for CVE-2026-53515?: Yes. @better-auth/sso (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53515 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53515?: Check whether you run Better-Auth SSO or @better-auth/sso (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@better-auth/sso (npm): upgrade to 1.6.11 or later
```
npm install @better-auth/sso@1.6.11
```

Technical details

The vulnerability exists in the 'POST /sso/register' endpoint of the '@better-auth/sso' package. While other management endpoints (list, update, delete) correctly enforce 'owner' or 'admin' roles via the 'isOrgAdmin' check, the registration path only verifies that the user is a member of the organization without checking their specific role. An attacker with low-privilege 'member' access can register a malicious OIDC or SAML provider. If organization provisioning is enabled, this can be used to inject new users into the organization, potentially with administrative privileges if 'defaultRole' is misconfigured. The issue is fixed in version 1.6.11 by implementing a mandatory role check during registration.

Affected products

better-auth @better-auth/sso >= 1.2.10, < 1.6.11

Identifiers

CVE-2026-53515
GHSA-gv74-j8m3-fg5f

Timeline

2026-04-12: disclosed: Public issue #9133 raised
2026-07-15: advisory: NVD publication date
2026-07-20: patched: GitHub Advisory published and fix confirmed in v1.6.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.