CyberRota Analysis
AI-GeneratedThe Better Auth library for TypeScript is vulnerable in versions prior to 1.6.11, specifically in the @better-auth/sso plugin, where certain endpoints allow attacker-controlled URLs to be processed without proper origin validation. This flaw can lead to non-blind server-side request forgery and potential account linking if the trustEmailVerified setting is enabled. Organizations using this library should prioritize upgrading to version 1.6.11 or later to mitigate these critical security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery and possible account linking when trustEmailVerified: true is configured. This issue is fixed in version 1.6.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)