CVE-2026-41427 Details
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.
A vulnerability exists in Better Auth's OAuth client creation process, specifically in versions 1.4.8-beta.7 prior to 1.6.5 and 1.7.0-beta.0 through 1.7.0-beta.1. The issue arises because the clientPrivileges option, intended to restrict client registration, was not properly enforced. As a result, any authenticated user could register an OAuth client with custom redirect URIs and metadata, bypassing the intended restrictions. This vulnerability is particularly concerning for deployments that relied on clientPrivileges to control who could create OAuth clients.
Users can upgrade to Better Auth version 1.6.5, where this vulnerability is fixed. If an immediate upgrade is not possible, the /oauth2/create-client and /admin/oauth2/create-client routes can be blocked at the reverse proxy or middleware layer for users who should not be able to register clients. It is also advisable not to expose the admin creation endpoint, as it is intended for server use only and should not be accessible to end-user sessions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth better-auth/oauth-provider | >= 1.4.9, < 1.6.5 1.4.8 - 1.4.8 beta7 1.7.0 beta0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | [email protected] |