A misconfiguration in the @better-auth/sso plugin permits an attacker to provide arbitrary OIDC endpoints via the oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint fields when skipDiscovery is set to true. These values are stored on the ssoProvider row without origin validation and fetched during the OIDC callback, enabling non‑blind server‑side request forgery and allowing the application to make arbitrary internal or external network requests. If trustEmailVerified is enabled, the attacker can also link victim accounts and gain unauthorized access to existing user accounts. The weakness corresponds to CWE‑20 (Improper Input Validation), CWE‑345 (Exploitable Sensitive Information), CWE‑441 (Insufficient Access Control), and CWE‑918 (Server‑Side Request Forgery).

The vulnerability affects the @better-auth/sso plugin and the Better Auth library. All installations running a version earlier than 1.6.11 are susceptible. Upgrading to v1.6.11 or later removes the flaw, as the update introduces origin validation for the provided endpoints and enforces stricter checks on the OIDC provider registration process.

With a CVSS score of 9.6 the flaw is considered Critical, indicating a high impact if exploited. The EPSS score of less than 1% suggests that the probability of exploitation at the current time is low, but the presence of a well‑defined attack vector—namely the uncontrolled registration of a new SSO provider—means that once an attacker obtains the ability to craft a registration request, they can perform SSRF against any reachable service. The vulnerability is not listed in the CISA KEV catalog, but its severity warrants immediate attention. Exploitation would typically involve an attacker sending a specially crafted POST request to /sso/register or /sso/update-provider with a skipDiscovery flag set and malicious endpoint URLs, which the application then follows during the callback.