cveboard RSS feed

CVE-2026-41427

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

better-auth

Vendor
better-auth
Product
better-auth
Platforms
Unknown
Default status
Unknown
better-auth · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 1.4.8-beta.7, < 1.6.5affectedUnavailableUnavailableUnavailableNone listed
>= 1.7.0-beta.0, <= 1.7.0-beta.1affectedUnavailableUnavailableUnavailableNone listed

oauth-provider

Vendor
better-auth
Product
oauth-provider
Platforms
Unknown
Default status
Unknown
oauth-provider · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 1.4.8-beta.7, < 1.6.5affectedUnavailableUnavailableUnavailableNone listed
>= 1.7.0-beta.0, <= 1.7.0-beta.1affectedUnavailableUnavailableUnavailableNone listed