better-auth v1.6.11 Patch: SSRF, OAuth Race Conditions, SCIM/SSO Privilege Escalation

Vulnerability Overview In version 1.6.11 of , several security vulnerabilities were addressed, primarily including: 1. Invitation Takeover Vulnerability: Fixed by enabling by default and extending validation gates to and . 2. OAuth Authorization Code Grant Race Condition: Fixed a race condition in the OAuth authorization code grant that allowed concurrent token exchange requests to generate multiple token sets from the same authorization code. 3. OAuth Refresh Token Rotation Race Condition: Fixed an issue in OAuth refresh token rotation that allowed concurrent requests to fork the refresh token family. Added a unique constraint on . 4. OAuth Account Linking Validation: Fixed an issue where OAuth account linking required verification of the local email address to link an OAuth identity to a local account. 5. SCIM Token Rejection: Fixed an issue where rejected values that conflicted with built-in account providers, preventing tokens from authenticating against unintended accounts. 6. SSO Provider Registration: Fixed an issue where registering an SSO provider required organization admin or owner roles, preventing any organization member from registering providers. 7. SSRF Vulnerability: Fixed an SSRF vulnerability by validating user-provided OIDC endpoint URLs against a whitelist of public routable hosts. Impact Scope better-auth: Affects all users of . @better-auth/oauth-provider: Affects users utilizing OAuth authorization code grant and refresh token rotation. @better-auth/scim: Affects users utilizing SCIM tokens. @better-auth/sso: Affects users utilizing SSO providers. Remediation Steps 1. Invitation Takeover Vulnerability: - Enable by default. - Extend validation gates to and . 2. OAuth Authorization Code Grant Race Condition: - Fixed the issue with concurrent token exchange requests. 3. OAuth Refresh Token Rotation Race Condition: - Fixed the issue with concurrent requests forking the refresh token family. - Added a unique constraint on . 4. OAuth Account Linking Validation: - Require verification of the local email address to link an OAuth identity to a local account. 5. SCIM Token Rejection: - Fixed to reject values that conflict with built-in account providers. 6. SSO Provider Registration: - Require organization admin or owner roles to register SSO providers. 7. SSRF Vulnerability: - Validate user-provided OIDC endpoint URLs against a whitelist of public routable hosts. POC Code or Exploit Code No specific POC code or exploit code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

better-auth v1.6.11 Patch: SSRF, OAuth Race Conditions, SCIM/SSO Privilege Escalation

More from this source