CVE-2026-41427
MEDIUMBetter Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
Title source: cnaDescription
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6
Scores
CVSS v3
6.5
EPSS
0.0021
EPSS Percentile
11.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (8)
better-auth/better-auth
>= 1.4.8-beta.7, < 1.6.5
better-auth/better-auth
>= 1.7.0-beta.0, <= 1.7.0-beta.1
better-auth/better-auth\/oauth-provider
1.4.8 (2 CPE variants)
better-auth/better-auth\/oauth-provider
1.7.0 beta0
better-auth/better-auth\/oauth-provider
1.4.9 - 1.6.5
better-auth/oauth-provider
1.4.8-beta.7 - 1.6.5npm
better-auth/oauth-provider
>= 1.4.8-beta.7, < 1.6.5
better-auth/oauth-provider
>= 1.7.0-beta.0, <= 1.7.0-beta.1
Published
Apr 24, 2026
Tracked Since
Apr 24, 2026