better-auth OIDC Endpoint SSRF Vulnerability and Remediation Analysis

Vulnerability Overview This vulnerability pertains to the validation of user-provided OIDC endpoint URLs during registration and update processes. When an SSO provider is registered without OIDC discovery, administrators directly provide four endpoint URLs (Authorization, Token, User Info, and JWKS). Prior to the fix, these URLs were accepted as-is without any validation. This could lead to the following two attack vectors: 1. Server-Side Request Forgery (SSRF): URLs pointing to internal addresses (such as cloud metadata services, database admin endpoints, or side-channels) could be used to read responses via the SSO flow. 2. Account Takeover: An attacker could set up a controlled Identity Provider (IDP) that returns account claims matching the victim's email address. Impact Scope Affected Component: OIDC endpoint handling logic within the library. Affected Users: All applications using the library for SSO integration. Potential Risks: Server-Side Request Forgery and Account Takeover. Remediation 1. Endpoint URL Validation: Validate each endpoint URL during registration to ensure its host is publicly routable on the internet or that its origin is listed in . 2. URL Type Checking: URLs are cast to the URL type before the schema layer, so malformed inputs will fail at the schema layer. 3. Code Changes: - Tighten the OIDC endpoint schema, changing from a generic string to a URL-validated string ( ), ensuring fast failure for malformed URLs. - Add to validate user-provided OIDC endpoint URLs via or by checking for allowed matches in . - Introduce the error code and mapping, and add integration tests covering rejection/acceptance scenarios for registration/update operations. POC Code No specific POC code is provided in the page, but the attack vectors and remediation measures are described.

Goal Reached Thanks to every supporter — we hit 100%!

better-auth OIDC Endpoint SSRF Vulnerability and Remediation Analysis

More from this source