Better Auth is an authentication and authorization library for TypeScript. The flaw lies in the @better-auth/sso plugin's POST /sso/register endpoint, where registerSSOProvider verifies only that the caller is a member of the organization and does not check for an owner or admin role. This omission allows any organization member to register an attacker-controlled OIDC or SAML provider, which can then be used to trigger the /sso/callback/{providerId} flow and provision the organization. The result is unauthorized privilege escalation within the Better Auth system, as the attacker can gain deep access to organizational resources. This weakness aligns with CWE-269, CWE-285, and CWE-863.

The vulnerability affects versions 1.2.10 through 1.6.11 of the @better-auth/sso plugin and the better-auth core library. All environments running these versions of Better Auth are susceptible, as the flaw resides in the SSO registration flow for all organizations using the plugin.

The likely attack vector is a crafted HTTP POST request to the /sso/register endpoint; this inference is derived from the description indicating that any organization member can use this endpoint to register providers. The CVSS scoring of 7.1 indicates a high severity. The EPSS score of less than 1% suggests that, while the flaw exists, the current likelihood of exploitation is low; the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted HTTP POST request to the /sso/register endpoint, and the attack can be carried out remotely by anyone with organization membership. The impact extends to the entire organization, including privileged resources and data, if an attacker can successfully register a malicious SSO provider. The presence of the flaw in the registration endpoint provides an empty authorization guard that can be abused to inject a malicious SSO provider.