CVE-2026-53515: Better Auth SSO Plugin Auth Bypass Flaw

CVE-2026-53515 Overview

CVE-2026-53515 is a privilege escalation vulnerability [CWE-269] in the Better Auth @better-auth/sso plugin. Better Auth is an authentication and authorization library for TypeScript. The flaw affects versions from 1.2.10 up to (but not including) 1.6.11. The POST /sso/register endpoint allows any organization member to attach a new Single Sign-On (SSO) provider to their organization. The registerSSOProvider function verifies only that a membership row exists and does not enforce an owner or admin role. Attackers can register controlled OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) providers and drive /sso/callback/{providerId} organization provisioning.

Critical Impact
Any authenticated organization member can register an attacker-controlled SSO provider, enabling account takeover of other members through malicious OIDC or SAML provisioning flows.

Affected Products

Better Auth @better-auth/sso plugin versions 1.2.10 through 1.6.10
Applications embedding Better Auth SSO with multi-tenant organizations
Deployments exposing the POST /sso/register endpoint to organization members

Discovery Timeline

2026-07-15 - CVE-2026-53515 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-53515

Vulnerability Analysis

The vulnerability is a missing authorization check in the SSO provider registration path. The registerSSOProvider handler in packages/sso/src/routes/sso.ts calls into an organization membership lookup and returns success whenever a membership row exists for the caller. Standard organization members, who should only consume authentication configuration, can therefore write it.

Once a member registers a provider, subsequent authentication flows against /sso/callback/{providerId} accept identity assertions from an attacker-controlled Identity Provider (IdP). Those assertions can create or link organization accounts, enabling impersonation of other users within the same organization and takeover of privileged roles through just-in-time provisioning.

Root Cause

The root cause is broken access control on a state-changing administrative endpoint. The isOrgAdmin helper existed but was not invoked by the register route, so role validation was absent. The fix in pull request #9220 introduces hasOrgAdminRole, which parses the comma-separated member.role field and requires membership in the ADMIN_ROLES = ["owner", "admin"] set before registration proceeds.

Attack Vector

An attacker with any valid organization membership sends an authenticated POST to /sso/register with SSO configuration pointing to an IdP they control. The server persists the provider under the target organization. The attacker then triggers /sso/callback/{providerId} and returns assertions that provision or link accounts.

typescript

// Security patch in packages/sso/src/routes/providers.ts
// fix(sso): require org admin role to register SSO providers (#9220)

const ADMIN_ROLES = ["owner", "admin"];

export function hasOrgAdminRole(member: Pick<Member, "role">): boolean {
	return member.role.split(",").some((r) => ADMIN_ROLES.includes(r.trim()));
}

async function isOrgAdmin(
	ctx: {
		context: {
// ...

Source: GitHub commit 86765f1

Detection Methods for CVE-2026-53515

Indicators of Compromise

Unexpected entries in the SSO provider table with issuer or entryPoint URLs pointing to unknown external domains.
POST /sso/register requests originating from user sessions that do not hold owner or admin organization roles.
New /sso/callback/{providerId} traffic for providers registered within the same session as a non-admin caller.

Detection Strategies

Audit the SSO provider table and correlate each row against the registering user's role at creation time.
Alert on any successful POST /sso/register where the acting member.role is not owner or admin.
Review organization membership changes that immediately follow a new SSO callback event for signs of just-in-time provisioning abuse.

Monitoring Recommendations

Log full request metadata (user ID, role, organization ID, IdP metadata URL) for every call to /sso/register.
Track first-seen IdP issuers per organization and alert on new external issuers.
Monitor authentication event volume on /sso/callback/{providerId} to detect provisioning bursts tied to a newly registered provider.

How to Mitigate CVE-2026-53515

Immediate Actions Required

Upgrade @better-auth/sso to version 1.6.11 or later without delay.
Enumerate all SSO providers registered since deploying version 1.2.10 and validate each against expected admin approvers.
Revoke provider entries created by non-admin members and invalidate sessions provisioned through those providers.

Patch Information

The fix is released in Better Auth version 1.6.11. Pull request #9220 adds the hasOrgAdminRole helper and requires owner or admin role membership before registerSSOProvider succeeds. See the GitHub Security Advisory GHSA-gv74-j8m3-fg5f and the v1.6.11 release notes for details.

Workarounds

Restrict network access to /sso/register at the reverse proxy so only administrative sessions can reach the route until the upgrade completes.
Add a middleware guard that rejects POST /sso/register when the caller's member.role is not owner or admin.
Temporarily disable the @better-auth/sso plugin in multi-tenant deployments where organization membership is not tightly controlled.

bash

# Upgrade Better Auth SSO plugin to the patched release
npm install @better-auth/sso@1.6.11

# Verify installed version
npm ls @better-auth/sso