@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-67328 via @better-auth/sso (>=1.3.28, <=1.6.20)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53515 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53515 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53513 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Am I affected? Users are affected if all of the following are true: - Their application uses @better-auth/sso at a version = 0.1.0, 1.6.11 on the stable line, or any 1.7.0-beta.x on the pre-release line. - The sso plugin is added to their application's betterAuth plugins: ... array. - Any user wi...

PT-2026-56298

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 0.1.0 through 1.6.10 @better-auth/sso versions 1.7.0-beta.x Description An SSRF flaw exists in the provider registration flow where OpenID Connect OIDC endpoint URLs are accepted without proper validation. When...