Skip to content
eastbaycyber

CVE-2026-53513: Better Auth SSO SSRF in OIDC endpoint handling

CVE explainers 9 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-15
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical SSRF in @better-auth/sso when skipDiscovery: true accepts attacker-controlled OIDC endpoints. - Affects Better Auth SSO deployments before 1.6.11; upgrade immediately. - No confirmed in-the-wild exploitation reported, but impact is high and auth infrastructure is sensitive.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-53513
CVSS 9.6 (Critical)
Attack vector Network
Privileges required Unknown from the NVD record; defenders should assume reachable authenticated functionality may be enough where provider registration/update is exposed
Patch available Yes, fixed in 1.6.11

This CVE affects the @better-auth/sso plugin used with Better Auth, a TypeScript authentication and authorization library. The bug is a server-side request forgery issue tied to how custom OIDC endpoints are accepted and later fetched when skipDiscovery: true is enabled.

The high-level risk is straightforward: if an attacker can get malicious endpoint URLs stored through the SSO provider registration or update flow, the application may later fetch those URLs from the server side during the OIDC callback process. That creates an SSRF primitive inside authentication infrastructure, which is exactly the kind of placement defenders should treat as high priority.

What Is This Vulnerability?

According to the NVD description, the vulnerable behavior exists in the @better-auth/sso plugin before version 1.6.11. Specifically, POST /sso/register and POST /sso/update-provider can accept attacker-controlled values for oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint when skipDiscovery: true is set. Those values are stored on the ssoProvider row without origin validation.

The issue becomes exploitable later in the OIDC callback flow, where the server fetches those previously stored URLs. That means the flaw is not just bad input validation on a configuration endpoint; it becomes a server-initiated request to attacker-chosen destinations. NVD explicitly describes this as non-blind SSRF, which suggests the response may be observable or otherwise useful to the attacker under some application flows.

A secondary impact is also called out: possible account linking when trustEmailVerified: true is configured. That matters because a vulnerability in SSO provider handling does not stop at network exposure. If a deployment makes optimistic trust decisions about verified email claims and provider metadata, a manipulated callback flow can potentially affect identity linkage and user trust boundaries.

Technical Notes

The vulnerable request path centers on the ability to submit custom OIDC endpoint values instead of relying on safe discovery. The dangerous condition is:

{
  "skipDiscovery": true,
  "oidcConfig": {
    "userInfoEndpoint": "http://attacker-or-internal-target.example/userinfo",
    "tokenEndpoint": "http://attacker-or-internal-target.example/token",
    "jwksEndpoint": "http://attacker-or-internal-target.example/jwks"
  }
}

Relevant endpoints named in the public description:

POST /sso/register
POST /sso/update-provider
AnalystImpact · assess the risk

Who Is Affected?

The confirmed affected component is @better-auth/sso. The most conservative primary-source statement is that versions prior to 1.6.11 are vulnerable. That version boundary is explicitly stated by NVD and by Better Auth’s security update material.

Additional advisory-indexed version granularity indicates the affected stable range is >= 0.1.0, < 1.6.11, and that 1.7.0-beta.x pre-release builds are also affected. Because not every version detail is equally exposed in the primary record, defenders should at minimum treat any deployment running before 1.6.11 as exposed until verified otherwise.

Exposure is configuration dependent. A deployment is meaningfully at risk when all of the following are true:

  1. It uses the @better-auth/sso plugin.
  2. It runs a vulnerable version before 1.6.11.
  3. It exposes or uses SSO provider registration or provider update functionality.
  4. It has skipDiscovery: true set for the relevant flow.

Risk increases further if trustEmailVerified: true is enabled, because the documented possible account-linking scenario depends on that trust setting. If you do not know whether these flags are enabled, assume potential exposure until configuration review proves otherwise.

Technical Notes

Quick package inventory checks:

npm ls @better-auth/sso

pnpm why @better-auth/sso

yarn why @better-auth/sso

Search code and configuration for the risky flags and endpoints:

grep -R "skipDiscovery" .
grep -R "trustEmailVerified" .
grep -R "/sso/register" .
grep -R "/sso/update-provider" .

CVSS Score Breakdown

NVD assigns this CVE a CVSS base score of 9.6, which places it in the Critical range. The vector string was not exposed in the record available for this session, so it would be wrong to invent the exact component values. Still, the score itself and the vulnerability description make the severity rationale clear.

A network-reachable flaw in authentication infrastructure that enables non-blind SSRF is serious even before considering the identity implications. SSRF can expose internal services, metadata endpoints, management interfaces, and trust relationships that are not intended to be internet-reachable. When the vulnerable component sits in an auth flow, defenders should also consider the blast radius across session handling, user identity, and administrative control paths.

The score is also consistent with the documented possibility of account linking under trustEmailVerified: true. That introduces a potential integrity impact beyond pure server-side network access. In practice, even if your environment has strong egress controls, a critical score should push this into the “patch now, investigate exposure, and review auth settings” bucket rather than routine backlog work.

Because the exact vector is not available here, defenders should avoid overfitting to assumptions like “no privileges required” or “low complexity.” Instead, validate whether users or admins can reach the provider management routes, and assess whether any tenant, partner, or self-service SSO flow could let an attacker persist arbitrary endpoint values.

Exploitation Status

At the time of this write-up, there is no confirmed evidence in the cited sources of active exploitation in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog based on the provided research note. That is useful context, but it should not reduce urgency for internet-facing or multi-tenant deployments.

There is also no confirmed public proof-of-concept repository in the source material provided. That means defenders should state the current status precisely: no known public PoC confirmed from the collected sources, and no confirmed active exploitation reported. It does not mean exploitation is difficult or unlikely. The vulnerability mechanics are direct enough that experienced attackers could likely reproduce the issue from the public description and patch diff.

In operational terms, this is the kind of flaw that can move quickly once attention builds around a fix release and advisory. Authentication-related SSRF bugs tend to attract scrutiny because they can expose high-value internal targets and identity workflows. If your deployment is internet-facing and supports dynamic SSO provider changes, assume opportunistic probing is plausible.

ResponderRunbook · act now

How to Detect It

Detection should focus on two phases: suspicious provider registration/update activity and suspicious outbound requests during OIDC callback handling. The strongest indicator is a request to /sso/register or /sso/update-provider that contains custom oidcConfig.*Endpoint values while skipDiscovery is enabled.

If you log request bodies, admin actions, or provider configuration changes, review them for endpoint values pointing to unusual hosts, RFC1918 addresses, localhost, cloud metadata IPs, or domains outside your approved identity provider list. If you do not currently log those fields, that visibility gap itself is worth addressing because configuration abuse in auth systems is often missed.

The second detection angle is outbound traffic. Watch for your Better Auth application making HTTP(S) requests to destinations that do not belong to approved OIDC providers, especially shortly after SSO provider creation or modification events. Correlating app logs with egress proxy, firewall, or DNS logs will usually produce the clearest signal.

Technical Notes

Example suspicious patterns to search for in application or reverse proxy logs:

POST /sso/register
POST /sso/update-provider
"skipDiscovery":true
"userInfoEndpoint":"http://127.0.0.1
"tokenEndpoint":"http://169.254.169.254
"jwksEndpoint":"http://10.

Example grep patterns for structured or plain logs:

grep -R -E '(/sso/register|/sso/update-provider)' /var/log
grep -R -E 'skipDiscovery.*true' /var/log
grep -R -E '(userInfoEndpoint|tokenEndpoint|jwksEndpoint).*?(127\.0\.0\.1|169\.254\.169\.254|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)' /var/log

Example Splunk query:

index=app_logs ("/sso/register" OR "/sso/update-provider")
| regex _raw="skipDiscovery["'=:\s]+true"
| regex _raw="(userInfoEndpoint|tokenEndpoint|jwksEndpoint)["'=:\s]+https?://"
| table _time, host, source, _raw

Example Sigma-style logic concept for proxy or egress telemetry:

title: Better Auth SSO Suspicious OIDC Endpoint Registration
logsource:
  product: webserver
detection:
  selection_uri:
    cs-uri-stem:
      - "/sso/register"
      - "/sso/update-provider"
  selection_body:
    request_body|contains:
      - "skipDiscovery"
      - "userInfoEndpoint"
      - "tokenEndpoint"
      - "jwksEndpoint"
  condition: selection_uri and selection_body
level: high

Mitigation and Patching

The primary fix is to upgrade to version 1.6.11. If you are on any release before 1.6.11, treat the system as vulnerable. If you are running a 1.7.0-beta.x pre-release build, review release notes and move to a fixed version aligned with the vendor’s advisory guidance. The public research note explicitly identifies 1.6.11 as the fixed version.

If you cannot patch immediately, reduce exposure by removing the vulnerable condition and tightening access. The most important workaround is to avoid using skipDiscovery: true unless absolutely necessary. Also restrict who can reach POST /sso/register and POST /sso/update-provider; these should be admin-only operations with strong authorization checks and auditing. If trustEmailVerified: true is enabled, reassess whether that trust model is needed until the patch is applied.

Network controls matter too. SSRF impact can be reduced by blocking application egress to internal ranges, localhost, link-local addresses, and cloud metadata endpoints where feasible. That is not a substitute for patching, but it can reduce blast radius if exploitation attempts occur before remediation is complete.

Technical Notes

Upgrade commands will depend on your package manager and how Better Auth is pinned. Examples:

npm install @better-auth/sso@1.6.11

pnpm add @better-auth/sso@1.6.11

yarn add @better-auth/sso@1.6.11

Verify the installed version after upgrade:

npm ls @better-auth/sso

Temporary workaround steps if immediate upgrade is blocked:

# 1) Search for risky config flags
grep -R "skipDiscovery" .
grep -R "trustEmailVerified" .

# 2) Disable or remove skipDiscovery where possible
# 3) Restrict access to SSO provider management routes at the proxy or app layer

Example reverse proxy restriction for provider-management endpoints:

location ~ ^/sso/(register|update-provider)$ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://app_backend;
}

If your environment supports egress filtering, explicitly deny metadata and loopback-style destinations from the app tier. Exact syntax varies by platform, but the security goal is consistent: the auth service should not be able to make arbitrary outbound calls to internal-only targets.

References

Primary reference for the CVE details and fix statement:

Vendor and project references that support affected component naming, fix version, and patch context:

For exploitation status tracking, confirm whether the CVE has entered broader exploited-vulnerability programs:

If some details remain unknown in your environment, assume the safer posture: treat any pre-1.6.11 deployment using @better-auth/sso with skipDiscovery: true as high priority until inventory, config review, and patch verification are complete.

For more information on secure design practices, visit our article on Secure by Design and to learn more about related vulnerabilities, check out CVE-2026-10561.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-15

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.