PT-2026-35070 · Unknown · Better Auth

Published 2026-04-16 · Updated 2026-04-25 · CVE-2026-41427

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.5

Description The OAuth client creation endpoints failed to invoke the hook associated with the clientPrivileges option before persisting new clients. Consequently, deployments intended to restrict client registration through clientPrivileges were ineffective, allowing any authenticated user to access the create endpoints and register an OAuth client with arbitrary redirect URIs and metadata.

Recommendations Update to version 1.6.5.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41427

GHSA-XR8F-H2GW-9XH6

Affected Products

Better Auth

References · 6

• https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr8f-h2gw-9xh6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41427 · Security Note
• https://github.com/better-auth/better-auth · Note
• https://twitter.com/VulmonFeeds/status/2047864455195660528 · Twitter Post
• https://twitter.com/CVEnew/status/2047798563997110278 · Twitter Post