CVE-2026-53513 Overview
CVE-2026-53513 is a server-side request forgery (SSRF) vulnerability in the Better Auth @better-auth/sso plugin, an authentication and authorization library for TypeScript. The flaw exists in the POST /sso/register and POST /sso/update-provider endpoints. When skipDiscovery: true is configured, these endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs. The library stores these URLs on the ssoProvider row without origin validation and fetches them during the OIDC callback. Versions prior to 1.6.11 are affected, and the issue is fixed in version 1.6.11.
Critical Impact
Authenticated attackers can trigger non-blind SSRF against internal services and achieve account linking when trustEmailVerified: true is set.
Affected Products
- Better Auth @better-auth/sso plugin prior to version 1.6.11
- Deployments configured with skipDiscovery: true
- Deployments configured with trustEmailVerified: true (account linking impact)
Discovery Timeline
- 2026-07-15 - CVE-2026-53513 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-53513
Vulnerability Analysis
The Better Auth SSO plugin implements OpenID Connect (OIDC) provider registration through two administrative endpoints. When developers set skipDiscovery: true, the plugin skips the standard OIDC discovery document lookup and instead accepts endpoint URLs directly from the request body. The plugin persists these URLs on the ssoProvider database row and later fetches them server-side during the OIDC callback flow. This flaw is classified as improper input validation [CWE-20].
An attacker with permission to call POST /sso/register or POST /sso/update-provider can supply URLs pointing to internal metadata services, loopback addresses, or private network resources. The server then issues outbound HTTP requests to these targets and returns response data through the OIDC callback, producing a non-blind SSRF condition.
Root Cause
The root cause is the absence of origin validation on user-supplied userInfoEndpoint, tokenEndpoint, and jwksEndpoint values. The pre-patch code path in packages/sso/src/oidc/discovery.ts did not verify that submitted URLs resolved to public routable hosts before storage or fetch. The patch introduces an isPublicRoutableHost check and new error codes including discovery_untrusted_origin and discovery_private_host.
Attack Vector
An authenticated user registers or updates an SSO provider with skipDiscovery: true and endpoint URLs pointing to internal targets. During the OIDC callback, the server fetches the attacker-controlled URLs and returns response data. When trustEmailVerified: true is set, an attacker can also forge a userinfo response that links the SSO identity to an existing account.
// Security patch in packages/sso/src/oidc/discovery.ts
// fix(sso): validate user-supplied OIDC endpoint URLs at registration and update
* @see https://openid.net/specs/openid-connect-discovery-1_0.html
*/
+import { isPublicRoutableHost } from "@better-auth/core/utils/host";
import { betterFetch } from "@better-fetch/fetch";
import type { OIDCConfig } from "../types";
Source: GitHub Commit 37f60cb
Detection Methods for CVE-2026-53513
Indicators of Compromise
- Outbound HTTP requests from the Better Auth service to RFC1918 addresses, 127.0.0.1, 169.254.169.254, or other internal hostnames
- ssoProvider database rows containing userInfoEndpoint, tokenEndpoint, or jwksEndpoint values that do not match the intended identity provider domain
- Unexpected calls to POST /sso/register or POST /sso/update-provider from non-administrative accounts
Detection Strategies
- Audit application logs for OIDC callback events that reference newly registered providers with non-public endpoint hosts
- Query the ssoProvider table for endpoint values whose hostnames resolve to private, link-local, or metadata service ranges
- Correlate sso/register and sso/update-provider API calls with subsequent unexpected internal HTTP traffic
Monitoring Recommendations
- Enable egress logging on hosts running Better Auth and alert on connections to cloud metadata endpoints such as 169.254.169.254
- Monitor for account linking events immediately following SSO provider updates when trustEmailVerified is enabled
- Track version telemetry to identify Better Auth deployments running versions earlier than 1.6.11
How to Mitigate CVE-2026-53513
Immediate Actions Required
- Upgrade @better-auth/sso to version 1.6.11 or later without delay
- Review all existing ssoProvider records and remove any with untrusted or internal endpoint URLs
- Restrict access to POST /sso/register and POST /sso/update-provider to trusted administrative principals only
- Disable trustEmailVerified: true unless the identity provider is fully controlled and validated
Patch Information
The fix is available in Better Auth version 1.6.11. See the GitHub Release v1.6.11, the GitHub Security Advisory GHSA-5rr4-8452-hf4v, and Pull Request #9574. The patch adds isPublicRoutableHost validation and new error codes discovery_untrusted_origin and discovery_private_host that return HTTP 400 for invalid endpoint URLs.
Workarounds
- Set skipDiscovery: false to force use of the OIDC discovery document instead of user-supplied endpoints
- Enforce an egress network policy that blocks outbound requests from the Better Auth service to private and metadata IP ranges
- Add an application-layer allowlist of trusted identity provider hostnames before writes to ssoProvider
# Upgrade to the patched version
npm install @better-auth/sso@1.6.11
# Verify the installed version
npm ls @better-auth/sso
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
