{"id":"CVE-2026-41427","summary":"Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients","details":"Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.","aliases":["GHSA-xr8f-h2gw-9xh6"],"modified":"2026-08-12T03:51:21.824883568Z","published":"2026-04-24T19:23:20.161Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41427.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41427.json"},{"type":"ADVISORY","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41427"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/better-auth/better-auth","events":[{"introduced":"35fcd1aa89b6e9978d7b34ec971066d6a8f1e4e3"},{"fixed":"c8a91f4167bd0e5e06e64e0a351307e0094ff0de"},{"introduced":"148b32e0cb5e143d31f070eaa2781d0cf471b928"},{"last_affected":"148b32e0cb5e143d31f070eaa2781d0cf471b928"}],"database_specific":{"extracted_events":[{"introduced":"1.4.9"},{"fixed":"1.6.5"},{"introduced":"1.4.8-NA"},{"last_affected":"1.4.8-NA"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:better-auth:better-auth\\/oauth-provider:*:*:*:*:*:node.js:*:*","cpe:2.3:a:better-auth:better-auth\\/oauth-provider:1.4.8:-:*:*:*:node.js:*:*"]}}],"versions":["1.4.8-NA","v1.4.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41427.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N"}]}