{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@better-auth/sso--1.2.10--1.6.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-53515"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@better-auth/sso (\u003e= 1.2.10, \u003c 1.6.11)"],"_cs_severities":["high"],"_cs_tags":["web","vulnerability","authorization-bypass","sso"],"_cs_type":"advisory","_cs_vendors":["Better Auth"],"content_html":"\u003cp\u003eA critical authorization bypass vulnerability, tracked as CVE-2026-53515, has been identified in the \u003ccode\u003e@better-auth/sso\u003c/code\u003e package, affecting versions \u003ccode\u003e\u0026gt;= 1.2.10\u003c/code\u003e and \u003ccode\u003e\u0026lt; 1.6.11\u003c/code\u003e. This flaw allows any member of an organization to register a new Single Sign-On (SSO) provider via the \u003ccode\u003ePOST /sso/register\u003c/code\u003e endpoint, even if they lack administrative privileges. The vulnerability arises because the endpoint checks for a valid membership but fails to verify the user's administrative role, a check that is enforced for other SSO provider management actions like listing, getting, updating, or deleting. This authorization mismatch enables unauthorized configuration of SSO providers and can lead to the creation of unapproved user accounts, and potentially administrative accounts, within the affected organization, especially if \u003ccode\u003eorganizationProvisioning.defaultRole\u003c/code\u003e is set to 'admin' or \u003ccode\u003edomainVerification.enabled\u003c/code\u003e is false. Organizations leveraging \u003ccode\u003esso()\u003c/code\u003e and \u003ccode\u003eorganization()\u003c/code\u003e plugins with a non-zero \u003ccode\u003eprovidersLimit\u003c/code\u003e are particularly at risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains or utilizes an existing regular member account within a target organization that uses \u003ccode\u003e@better-auth/sso\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts and sends an HTTP POST request to the \u003ccode\u003e/sso/register\u003c/code\u003e endpoint, including details for a new, attacker-controlled OIDC or SAML identity provider, specifying the target \u003ccode\u003eorganizationId\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the authorization bypass (CVE-2026-53515), the \u003ccode\u003e@better-auth/sso\u003c/code\u003e application successfully processes the registration without verifying the caller's administrative role.\u003c/li\u003e\n\u003cli\u003eA new, attacker-controlled SSO provider is created and illicitly associated with the target organization.\u003c/li\u003e\n\u003cli\u003eThe attacker then directs users (or themselves) to authenticate via this newly registered SSO provider, which processes identities through the \u003ccode\u003e/sso/callback/{providerId}\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe application's \u003ccode\u003eorganizationProvisioning\u003c/code\u003e mechanism adds these IdP-asserted users into the target organization.\u003c/li\u003e\n\u003cli\u003eIf the \u003ccode\u003eorganizationProvisioning.defaultRole\u003c/code\u003e or \u003ccode\u003eorganizationProvisioning.getRole\u003c/code\u003e is configured to return \u003ccode\u003eadmin\u003c/code\u003e for provisioned users, the attacker can create new administrative accounts.\u003c/li\u003e\n\u003cli\u003eThe final objective is unauthorized control over SSO configurations, unauthorized user creation, or potentially unauthorized administrative access within the target organization.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability can lead to several severe consequences for affected organizations. The primary impact is the unauthorized configuration of SSO providers, allowing a low-privileged member to link an attacker-controlled identity provider to the organization. This can further lead to unauthorized organization membership creation, where IdP-asserted users are added to the target organization without proper oversight. In the worst-case scenario, if \u003ccode\u003eorganizationProvisioning.defaultRole\u003c/code\u003e is set to \u003ccode\u003eadmin\u003c/code\u003e or \u003ccode\u003eorganizationProvisioning.getRole\u003c/code\u003e returns \u003ccode\u003eadmin\u003c/code\u003e, the issue can result in the creation of administrative-level accounts within the organization without owner consent, effectively granting an attacker broad control. The immediate usability of a malicious provider is heightened if \u003ccode\u003edomainVerification.enabled\u003c/code\u003e is \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-53515 immediately\u003c/strong\u003e by upgrading to \u003ccode\u003e@better-auth/sso@1.6.11\u003c/code\u003e or later to ensure the \u003ccode\u003eregisterSSOProvider\u003c/code\u003e handler enforces the correct administrative role check.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDisable user-driven SSO registration\u003c/strong\u003e by setting \u003ccode\u003esso({ providersLimit: 0 })\u003c/code\u003e if immediate upgrade is not possible. This will prevent all self-serve provider creation, requiring server-side calls for legitimate registrations.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDisable SSO-driven organization provisioning\u003c/strong\u003e by setting \u003ccode\u003esso({ organizationProvisioning: { disabled: true } })\u003c/code\u003e if direct upgrade is unfeasible, which will prevent the malicious provider from automatically adding users.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement a custom \u003ccode\u003ebefore\u003c/code\u003e hook\u003c/strong\u003e on \u003ccode\u003e/sso/register\u003c/code\u003e that explicitly asserts the caller's role on \u003ccode\u003ebody.organizationId\u003c/code\u003e is \u003ccode\u003eowner\u003c/code\u003e or \u003ccode\u003eadmin\u003c/code\u003e as a temporary workaround until patching is complete.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAudit existing \u003ccode\u003essoProvider\u003c/code\u003e rows\u003c/strong\u003e where \u003ccode\u003eorganizationId IS NOT NULL\u003c/code\u003e and cross-reference the \u003ccode\u003euserId\u003c/code\u003e with \u003ccode\u003emember.role\u003c/code\u003e to identify and remove provider records created by non-admin users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:10:10Z","date_published":"2026-07-20T21:10:10Z","id":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-sso-auth-bypass/","summary":"A high-severity authorization bypass vulnerability (CVE-2026-53515) in `@better-auth/sso` versions `\u003e= 1.2.10, \u003c 1.6.11` allows regular organization members to register new SSO providers for an organization, potentially leading to unauthorized user creation and, under specific configurations, unauthorized administrative access within the target organization.","title":"@better-auth/sso Authorization Bypass Allows Unauthorized SSO Provider Registration","url":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-sso-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Better-Auth/Sso (\u003e= 1.2.10, \u003c 1.6.11)","version":"https://jsonfeed.org/version/1.1"}