CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict client registration were not actually restricted — any authenticated user could reach the create endpoints and register an OAuth client with attacker-chosen redirect URIs and metadata. This vulnerability is fixed in 1.6.5.

The following products are affected by CVE-2026-41427 vulnerability.

No data.

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41427.

URL	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-xr8f-h2gw-9xh6