Oauth Provider
Approved changes feed: RSS · Atom
cpe:2.3:a:better-auth:oauth-provider:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Better Auth (055dad77-703f-5718-95a3-286dc3d3b775) |
|---|---|
| Product | Oauth Provider (c6a95edd-85b3-5dcf-a8f9-73631b8584ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/better-auth/better-auth |
purl2cpe | 2026-09-09 08:34:19.282595 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-67332 |
vulnerable | 2026-09-16 04:33:05.680502 |
@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
MEDIUM (6.4)
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
Published: 2026-08-01T12:22:18.036Z
Updated: 2026-10-08T15:24:10.829Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41427 |
vulnerable | 2026-06-08 08:03:15.373104 |
Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.
Published: 2026-04-24T19:23:20.161Z
Updated: 2026-04-27T13:42:23.885Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.