CVE-2026-41427

Description

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4