CyberRota Analysis
AI-GeneratedThe Better Auth library for TypeScript, specifically versions 1.2.10 to 1.6.10, contains a vulnerability in the @better-auth/sso plugin that allows any organization member to register a new SSO provider without proper authorization checks. This flaw could enable attackers to integrate malicious OIDC or SAML providers, compromising the security of the organization’s authentication process. Organizations using affected versions should prioritize upgrading to version 1.6.11 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to drive /sso/callback/{providerId} organization provisioning. This issue is fixed in version 1.6.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)