better-auth vulnerabilities (npm)
27 vulnerabilities.
-
better-authnpm Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy 9.1 Critical -
better-authnpm better-auth: OAuth state can be used as a Magic Link to sign in as another user 9.1 Critical -
better-authnpm Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link 9.3 Critical -
better-authnpm Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 6.3 Medium -
better-authnpm better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device 8.5 High -
better-authnpm better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP 8.7 High -
better-authnpm better-auth Stale Sessions Persist After User Deletion 5.1 Medium -
better-authnpm Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption 7.6 High -
better-authnpm Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking 8.1 High -
better-authnpm better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider 9.4 Critical -
better-authnpm better-auth before 1.6.13 Stored XSS via javascript redirect_uri 5.1 Medium -
better-authnpm Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email 8.3 High -
better-authnpm Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin 7.7 High -
better-authnpm Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins 9.1 Critical -
better-authnpm Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending 7.6 High -
better-authnpm Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation 7.3 High -
better-authnpm better-auth before 1.6.2 OAuth State Validation Bypass 6.0 Medium -
better-authnpm better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache 7.1 High -
better-authnpm Better Auth before 1.4.5 Path Normalization Bypass via rou3 8.8 High -
better-authnpm better-auth before 1.4.2 basePath Modification DoS 9.3 Critical -
better-authnpm better-auth before 1.4.0 Session Revocation via Forged Cookie 2.0 Low -
better-authnpm Better Auth: Unauthenticated API key creation through api-key plugin 9.3 Critical -
better-authnpm Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes 2.1 Low -
better-authnpm better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass 7.1 High -
better-authnpm Beter Auth has an Open Redirect via Scheme-Less Callback Parameter 6.9 Medium -
better-authnpm better-auth before 1.1.16 Reflected XSS via error parameter 5.1 Medium -
better-authnpm Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint 7.9 High