Skip to content
Better-auth Better Auth vulnerabilities
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
CVE-2026-53515
Fix available
7.1 High
-
better-auth, better-auth better auth, better-auth\/oauth-provider +2 more
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
CVE-2026-53518
Fix available
7.6 High
-
@better-auth sso, better-auth, better-auth better auth +1 more +3 more
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
CVE-2026-53513
Fix available
9.6 Critical
-
@better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 more
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
CVE-2026-53517
Fix available
8.1 High
-
better-auth better auth, better-auth +1 more
Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
CVE-2026-53516
Fix available
8.3 High
-
better-auth better auth, better-auth +1 more
Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
CVE-2026-53514
Fix available
7.7 High
-
better-auth, better-auth better auth +1 more
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
CVE-2026-53512
Fix available
9.1 Critical
-
better-auth better auth, better-auth +1 more
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
CVE-2026-45337
Fix available
7.6 High
-
better-auth better auth, better-auth +1 more
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
CVE-2025-27143
Fix available
6.9 Medium
-
better-auth better auth, better-auth +1 more
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
CVE-2024-56734
Fix available
7.9 High