Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NBetter Auth
APPBetter-Auth1.2.10 – 1.6.11 (excl.)Better Auth Better Auth\/sso
APPBetter-Auth< 1.6.11
Related vulnerabilities
SSRF w Better Auth — niezweryfikowane endpointy OIDC w pluginie SSO
Better Auth: pominięcie weryfikacji client_secret w endpointach OAuth token
Race condition w Better Auth umożliwia wielokrotne użycie kodu autoryzacyjnego OAuth2
Better Auth: błędna autoryzacja w pluginie deviceAuthorization umożliwia przejęcie sesji urządzenia
Better Auth: Auth Bypass przez nieprawidłowe wiązanie konta OAuth