Skip to content
@better-auth vulnerabilities
Newest
-
@better-auth sso
Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
CVE-2026-110863
8.6 High
-
@better-auth sso
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
CVE-2026-80192
8.6 High
-
@better-auth sso
@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2026-67328
8.6 High
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
CVE-2026-53515
Fix available
7.1 High
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
CVE-2026-53513
Fix available
9.6 Critical
-
@better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 more
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
CVE-2026-53517
Fix available
8.1 High