Skip to content
Better-auth vulnerabilities
Newest
-
better-auth better auth
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated...
CVE-2026-121802
9.1 Critical
-
better-auth
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
CVE-2026-110864
Fix available
9.1 Critical
-
@better-auth sso
Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
CVE-2026-110863
8.6 High
-
better-auth
better-auth: OAuth state can be used as a Magic Link to sign in as another user
CVE-2026-114607
Fix available
9.1 Critical
-
better-auth
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
CVE-2026-110862
9.3 Critical
-
better-auth, better-auth drizzle-adapter, kysely-adapter +2 more
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
CVE-2026-110861
Fix available
6.3 Medium
-
better-auth
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
CVE-2026-109346
Fix available
8.5 High
-
@better-auth sso
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
CVE-2026-80192
8.6 High
-
@better-auth sso
@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2026-67328
8.6 High
-
better-auth
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-67327
Fix available
8.7 High
-
better-auth stripe
@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2026-67329
Fix available
7.1 High
-
better-auth scim
better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
CVE-2026-67330
Fix available
9.4 Critical
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
CVE-2026-53515
Fix available
7.1 High
-
better-auth better-icons
better-auth better-icons scan_project_icons/sync_icon path traversal
CVE-2026-15527
4.8 Medium
-
better-auth scim
better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67331
Fix available
8.7 High
-
better-auth
better-auth Stale Sessions Persist After User Deletion
CVE-2026-67334
Fix available
5.1 Medium
-
better-auth, better-auth better auth, better-auth\/oauth-provider +2 more
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
CVE-2026-53518
Fix available
7.6 High
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
CVE-2026-53513
Fix available
9.6 Critical
-
@better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 more
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
CVE-2026-53517
Fix available
8.1 High
-
better-auth
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
CVE-2026-67336
Fix available
9.4 Critical
-
better-auth
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-67333
Fix available
5.1 Medium
-
better-auth better auth, better-auth +1 more
Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
CVE-2026-53516
Fix available
8.3 High
-
better-auth better auth, better-auth +1 more
Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
CVE-2026-53514
Fix available
7.7 High
-
better-auth oauth-provider
@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67332
Fix available
5.3 Medium
-
better-auth, better-auth better auth +1 more
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
CVE-2026-53512
Fix available
9.1 Critical
-
better-auth better auth, better-auth +1 more
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
CVE-2026-45337
Fix available
7.6 High
-
better-auth
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
CVE-2026-45364
Fix available
7.3 High
-
better-auth
better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2026-67335
Fix available
6.0 Medium
-
better-auth, better-auth better-auth\/oauth-provider, oauth-provider +2 more
Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
CVE-2026-41427
Fix available
7.1 High
-
better-auth
better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
CVE-2026-67337
Fix available
7.1 High
-
better-auth
Better Auth before 1.4.5 Path Normalization Bypass via rou3
CVE-2025-71399
Fix available
8.8 High
-
better-auth
better-auth before 1.4.2 basePath Modification DoS
CVE-2025-71401
Fix available
9.3 Critical
-
better-auth
better-auth before 1.4.0 Session Revocation via Forged Cookie
CVE-2025-71402
Fix available
2.0 Low
-
better-auth passkey
better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2025-71400
Fix available
7.1 High
-
better-auth
Better Auth: Unauthenticated API key creation through api-key plugin
CVE-2025-61928
Fix available
EPSS 19.7%
9.3 Critical
-
better-auth
Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
CVE-2025-53535
Fix available
2.1 Low
-
better-auth
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2025-71403
Fix available
7.1 High
-
better-auth better auth, better-auth +1 more
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
CVE-2025-27143
Fix available
6.9 Medium
-
better-auth
better-auth before 1.1.16 Reflected XSS via error parameter
CVE-2025-71404
Fix available
5.1 Medium
-
better-auth better auth, better-auth +1 more
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
CVE-2024-56734
Fix available
7.9 High