{"id":"GHSA-xr8f-h2gw-9xh6","revision":"89f165f019c3434daaf7a095b2733e64","records":[{"revision":"89f165f019c3434daaf7a095b2733e64","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xr8f-h2gw-9xh6","aliases":["CVE-2026-41427"],"title":"OAuth 2.1 Provider: Unprivileged users can register OAuth clients","description":"### Am I affected?\n\n  You're affected if all of the following are true:\n\n  - Using @better-auth/oauth-provider at version specified below \n  - You configured clientPrivileges in the plugin options expecting it to gate who can create OAuth clients\n  - The /oauth2/create-client or /admin/oauth2/create-client endpoints are reachable by authenticated users you don't fully trust\n\n  If clientPrivileges is not configured, this bug has no security consequence for your deployment\n\n  ---\n  ### Summary\n\n  The clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata.\n\n Non-create operations (read, list, update, delete, rotate) enforced the hook correctly. Only the create path was missing the check.\n\n### Impact\n\n  - Unauthorized registration of OAuth clients by any authenticated user, under deployments that expected clientPrivileges to block them.\n  - Attacker-controlled redirect_uris on those clients enable phishing flows that present as registered first-party applications.\n  - If the SERVER_ONLY admin creation endpoint is also exposed to low-privilege users (a separate deployment misconfiguration), additional sensitive fields including `skip_consent` become writable.\n\n### Patches\n\nFixed in `@better-auth/oauth-provider@1.6.5` Both create endpoints now call the clientPrivileges hook with action \"create\" before persisting the client record.\n\n### Workarounds\n\n  If you cannot upgrade immediately:\n\n  - Block the /oauth2/create-client and /admin/oauth2/create-client routes at your reverse proxy or middleware layer for any user who should not be able to register clients.\n  - Do not expose the admin creation endpoint (it is SERVER_ONLY by design and should not be reachable by end-user sessions).","state":0,"publishedAt":"2026-04-16T22:44:27+00:00","modifiedAt":"2026-05-05T16:26:32.977559+00:00","affected":[{"ecosystem":"npm","name":"@better-auth/oauth-provider","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.4.8-beta.7"},{"kind":"fixed","version":"1.6.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@better-auth/oauth-provider","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0-beta.0"},{"kind":"last_affected","version":"1.7.0-beta.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6","https://nvd.nist.gov/vuln/detail/CVE-2026-41427","https://github.com/better-auth/better-auth"],"sourceUrl":"https://github.com/advisories/GHSA-xr8f-h2gw-9xh6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xr8f-h2gw-9xh6","identifiers":["GHSA-xr8f-h2gw-9xh6","CVE-2026-41427"]},"retained":false,"historicalAffected":[]}],"coverage":[]}