https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 10:03:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-293123 EUVD-2026-293123 https://cve.radiocsirt.org/vuln/euvd-2026-293123 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41427 <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.</p> <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41427 https://cve.radiocsirt.org/vuln/ghsa-xr8f-h2gw-9xh6 <p><strong>Affected:</strong> npm: @better-auth/oauth-provider</p> <p>### Am I affected?</p> <p>You&#39;re affected if all of the following are true:</p> <p>- Using @better-auth/oauth-provider at version specified below - You configured clientPrivileges in the plugin options expecting it to gate who can create OAuth clients - The /oauth2/create-client or /admin/oauth2/create-client endpoints are reachable by authenticated users you don&#39;t fully trust</p> <p>If clientPrivileges is not configured, this bug has no security consequence for your deployment</p> <p>--- ### Summary</p> <p>The clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata.</p> <p>Non-create operations (read, list, update, delete, rotate) enforced the hook correctly. Only the create path was missing the check.</p> <p>### Impact</p> <p>- Unauthorized registration of OAuth clients by any authenticated user, under deployments that expected clientPrivileges to block them. - Attacker-controlled redirect_uris on those clients enable phishing flows that present as registered first-party applications. - If the SERVER_ONLY admin creation endpoint is also exposed to low-privilege users (a separate deployment misconfiguration), additional sensitive fields including `skip_consent` become writ…</p> <p><strong>Affected:</strong> npm: @better-auth/oauth-provider</p> <p>### Am I affected?</p> <p>You&#39;re affected if all of the following are true:</p> <p>- Using @better-auth/oauth-provider at version specified below - You configured clientPrivileges in the plugin options expecting it to gate who can create OAuth clients - The /oauth2/create-client or /admin/oauth2/create-client endpoints are reachable by authenticated users you don&#39;t fully trust</p> <p>If clientPrivileges is not configured, this bug has no security consequence for your deployment</p> <p>--- ### Summary</p> <p>The clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata.</p> <p>Non-create operations (read, list, update, delete, rotate) enforced the hook correctly. Only the create path was missing the check.</p> <p>### Impact</p> <p>- Unauthorized registration of OAuth clients by any authenticated user, under deployments that expected clientPrivileges to block them. - Attacker-controlled redirect_uris on those clients enable phishing flows that present as registered first-party applications. - If the SERVER_ONLY admin creation endpoint is also exposed to low-privilege users (a separate deployment misconfiguration), additional sensitive fields including `skip_consent` become writ…</p> https://cve.radiocsirt.org/vuln/ghsa-xr8f-h2gw-9xh6