# CVE-2026-53515: Better Auth improper authorization in SSO provider registration

Source: https://junglewise.ai/threats/cve-2026-53515-better-auth-improper-authorization-in-sso-provider-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-53515 · Severity: high · CVSS 7.1 · Published 2026-07-15

A vulnerability in the Better Auth SSO plugin allows regular organization members to register their own Single Sign-On (SSO) providers without administrative approval. This could allow an attacker to link a malicious identity provider to an organization, potentially leading to unauthorized account creation or administrative access within that organization. This affects applications using both the SSO and Organization plugins where user-driven registration is enabled.

Technologies: [Better-Auth SSO](https://junglewise.ai/threats/technologies/sso). Vendors: [Better-Auth](https://junglewise.ai/threats/vendors/better-auth), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53515 being exploited in the wild.

**How severe is CVE-2026-53515?** High severity, with a CVSS score of 7.1, published 15 July 2026.

**Which products and versions are affected?** Better-Auth SSO >= 1.2.10, < 1.6.11; @better-auth/sso (npm) >= 1.2.10, < 1.6.11, SEMVER:introduced=1.2.10,fixed=1.6.11.

**Is there a fix for CVE-2026-53515?** Yes. @better-auth/sso (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53515 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53515?** Check whether you run Better-Auth SSO or @better-auth/sso (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @better-auth/sso (npm): upgrade to 1.6.11 or later

  ```sh
  npm install @better-auth/sso@1.6.11
  ```


## Technical details

The vulnerability exists in the 'POST /sso/register' endpoint of the '@better-auth/sso' package. While other management endpoints (list, update, delete) correctly enforce 'owner' or 'admin' roles via the 'isOrgAdmin' check, the registration path only verifies that the user is a member of the organization without checking their specific role. An attacker with low-privilege 'member' access can register a malicious OIDC or SAML provider. If organization provisioning is enabled, this can be used to inject new users into the organization, potentially with administrative privileges if 'defaultRole' is misconfigured. The issue is fixed in version 1.6.11 by implementing a mandatory role check during registration.

## Affected products

- better-auth @better-auth/sso >= 1.2.10, < 1.6.11

## Identifiers

- CVE-2026-53515
- GHSA-gv74-j8m3-fg5f

## Timeline

- 2026-04-12: disclosed: Public issue #9133 raised
- 2026-07-15: advisory: NVD publication date
- 2026-07-20: patched: GitHub Advisory published and fix confirmed in v1.6.11

## References

- [https://api.github.com/users/Nadav0077](https://api.github.com/users/Nadav0077)
- [https://github.com/Nadav0077](https://github.com/Nadav0077)
- [https://api.github.com/users/Nadav0077/gists%7B/gist_id%7D](https://api.github.com/users/Nadav0077/gists%7B/gist_id%7D)
- [https://api.github.com/users/Nadav0077/repos](https://api.github.com/users/Nadav0077/repos)
- [https://avatars.githubusercontent.com/u/18245584?v=4](https://avatars.githubusercontent.com/u/18245584?v=4)
- [https://api.github.com/users/Nadav0077/events%7B/privacy%7D](https://api.github.com/users/Nadav0077/events%7B/privacy%7D)

## Related threats

- [better-auth SSO domain ownership flaw in authentication](https://junglewise.ai/threats/cve-2026-80192-better-auth-sso-domain-ownership-flaw-in-authentication)
- [better-auth SSO multiple authentication bypass vulnerabilities](https://junglewise.ai/threats/cve-2026-67328-better-auth-sso-multiple-authentication-bypass-vulnerabilities)
- [Better Auth SSRF and account takeover in @better-auth/sso plugin](https://junglewise.ai/threats/cve-2026-53513-better-auth-ssrf-and-account-takeover-in-better-auth-sso-plugin)