@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Description

Users are affected if all of the following are true:

• Their application uses @better-auth/sso at a version >= 0.1.0, < 1.6.11 on the stable line, or any 1.7.0-beta.x on the pre-release line.
• The sso() plugin is added to their application’s betterAuth({ plugins: [...] }) array.

Recommendation

Update the @better-auth/sso package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.1.0, < 1.6.11
• Patched version(s): 1.6.11

References

• GHSA-5rr4-8452-hf4v
• CVE-2026-53513
• CWE-20
• CWE-345
• CWE-441
• CWE-918
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A10
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• @better-auth/sso: SSO provider may allow registration for any org member without a checking their role - CVE-2026-53515
• HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis - CVE-2026-46391
• LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
• BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue - CVE-2026-7223

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@better-auth/sso