{"id":"EUVD-2026-25617","enisaUuid":"440e1fe8-41e5-3095-87ef-564bd2532c4a","description":"Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.","datePublished":"Apr 24, 2026, 7:23:20 PM","dateUpdated":"Apr 27, 2026, 1:42:23 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6\n","aliases":"CVE-2026-41427\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"16d9a95e-ba82-326f-9c66-3689a64c1636","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.7.0-beta.0, ≤ 1.7.0-beta.1"},{"id":"1ae1858f-6b4f-3108-8f49-a968ef51ae41","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.4.8-beta.7, \u003c 1.6.5"},{"id":"53fd585e-56fc-332e-a971-448b8053caf6","product":{"name":"oauth-provider","vendor":{"name":"better-auth"}},"product_version":"1.4.8-beta.7, \u003c 1.6.5"},{"id":"f360207e-1239-3519-92b1-165f6fd89dfd","product":{"name":"oauth-provider","vendor":{"name":"better-auth"}},"product_version":"1.7.0-beta.0, ≤ 1.7.0-beta.1"}],"enisaIdVendor":[{"id":"052437fe-e231-3402-86b5-989b6f8e1f65","vendor":{"name":"better-auth"}}],"enisaIdVulnerability":[{"id":"ac3e07da-fb6b-3bd9-8189-d4d24d277138","vulnerability":{"id":"CVE-2026-41427","description":"Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.","datePublished":"Apr 24, 2026, 7:23:20 PM","dateUpdated":"Apr 27, 2026, 1:42:23 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6\n","enisa_id":"EUVD-2026-25617\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"0236bd1c-c856-3bdb-9eda-c4e1bf0e65c8","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.4.8-beta.7, \u003c 1.6.5"},{"id":"0c3453fc-eff1-39fd-b623-fbc0f3051ecd","product":{"name":"oauth-provider","vendor":{"name":"better-auth"}},"product_version":"1.7.0-beta.0, ≤ 1.7.0-beta.1"},{"id":"b35607c6-6938-3b9e-8b13-09014f8f548b","product":{"name":"oauth-provider","vendor":{"name":"better-auth"}},"product_version":"1.4.8-beta.7, \u003c 1.6.5"},{"id":"ec670277-41f8-32df-a21a-711bb249f3f3","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.7.0-beta.0, ≤ 1.7.0-beta.1"}],"vulnerabilityVendor":[{"id":"3251b3fd-6d21-35c6-bba3-d7ba3ab46352","vendor":{"name":"better-auth"}}]}}],"enisaIdAdvisory":[]}