CVE-2026-41427: Better-Auth Better-Auth/oauth-Provider

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

Affected products

• Better-Auth Better-Auth/oauth-Provider: from 1.4.9, before 1.6.5 (fixed in 1.6.5); version 1.4.8 only; version 1.7.0 only

Published 2026-04-24. Last modified 2026-06-17.