@better-auth/sso BOLA: Non-admin SSO Registration Privilege Escalation (CVE-2026-53515)

Vulnerability Overview Title: @better-auth/sso: SSO provider registration allows any organization member without verifying their role Description: This vulnerability allows any member of an organization (even non-administrators) to register a new SSO provider. The flaw resides in the endpoint of the package, which permits any organization member to register a new SSO provider without verifying whether the caller holds an administrator role within the organization. This results in an authorization mismatch, as other SSO provider management endpoints associated with the organization treat SSO providers as resources managed by administrators. Scope of Impact Affected Versions: Fixed Version: CVSS Score: 7.1 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: High Availability: None Remediation 1. Upgrade: Upgrade to or a later version. 2. If immediate upgrade is not possible: - Disable user-driven SSO registration: Configure to return before membership level checks. - Disable SSO-driven organization provisioning: Configure . While malicious providers can still be registered, SSO callbacks will no longer automatically add users to the target organization. - Custom hook: Assert the caller's role on . If the user holds the or role for the , apply the patch logic. - Audit existing records: List rows where is true and is not NULL. Cross-reference each with the roles to identify and remove provider records where the creator no longer holds the or role. Detailed Information Issue: The endpoint in allows any organization member to register a new SSO provider without verifying whether the caller possesses an administrator role within the organization. Fix: In , when an is provided and the plugin is enabled, the handler now requires the caller to hold the or role in the target organization. References CVE ID: CVE-2026-53515 Weaknesses: CWE-863, CWE-285, CWE-269 Reporter: @NadaV077

Goal Reached Thanks to every supporter — we hit 100%!

@better-auth/sso BOLA: Non-admin SSO Registration Privilege Escalation (CVE-2026-53515)

More from this source