{"id":"CVE-2026-41427","aliases":["GHSA-xr8f-h2gw-9xh6"],"url":"https://o3.security/vulnerability/CVE-2026-41427","summary":"Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients","details":"### Am I affected?\n\n  You're affected if all of the following are true:\n\n  - Using @better-auth/oauth-provider at version specified below \n  - You configured clientPrivileges in the plugin options expecting it to gate who can create OAuth clients\n  - The /oauth2/create-client or /admin/oauth2/create-client endpoints are reachable by authenticated users you don't fully trust\n\n  If clientPrivileges is not configured, this bug has no security consequence for your deployment\n\n  ---\n  ### Summary\n\n  The clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata.\n\n Non-create operations (read, list, update, delete, rotate) enforced the hook correctly. Only the create path was missing the check.\n\n### Impact\n\n  - Unauthorized registration of OAuth clients by any authenticated user, under deployments that expected clientPrivileges to block them.\n  - Attacker-controlled redirect_uris on those clients enable phishing flows that present as registered first-party applications.\n  - If the SERVER_ONLY admin creation endpoint is also exposed to low-privilege users (a separate deployment misconfiguration), additional sensitive fields including `skip_consent` become writable.\n\n### Patches\n\nFixed in `@better-auth/oauth-provider@1.6.5` Both create endpoints now call the clientPrivileges hook with action \"create\" before persisting the client record.\n\n### Workarounds\n\n  If you cannot upgrade immediately:\n\n  - Block the /oauth2/create-client and /admin/oauth2/create-client routes at your reverse proxy or middleware layer for any user who should not be able to register clients.\n  - Do not expose the admin creation endpoint (it is SERVER_ONLY by design and should not be reachable by end-user sessions).","published":"2026-04-24T19:23:20.161Z","modified":"2026-08-12T03:51:21.824883568Z","cvss":null,"epss":{"score":0.00212,"percentile":0.11642,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@better-auth/oauth-provider","fixedVersion":"1.6.5"},{"ecosystem":"npm","name":"@better-auth/oauth-provider","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41427.json"},{"type":"ADVISORY","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41427"},{"type":"PACKAGE","url":"https://github.com/better-auth/better-auth"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.824883568Z"}}