npmPackage

better-auth

27 known vulnerabilities (7 critical, 12 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release: 1.7.18 (Nov 5, 2026): no advisory affects it
Newest unaffected release: 1.7.18 (Nov 5, 2026), the latest release
Advisories: 27 · 7 critical, 12 high, 6 medium, 2 low

Weekly downloads: 17.1M
Releases: 500+ since 1.0.9 (Dec 3, 2024)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-114607
Affects 1.4.0-beta.18 to 1.7.6 (1.7.7 is outside it)
CVE-2026-110864
Affects 1.5.0-beta.12 to 1.7.6 (1.7.7 is outside it)
CVE-2026-110862
Affects 1.4.0-beta.18 to 1.7.6 (1.7.7 is outside it)
CVE-2026-110861
Affects 1.6.17 to 1.7.6 (1.7.7 is outside it)
CVE-2026-109346
Affects 1.3.8-beta.3 to 1.7.0-rc.2 (1.7.0-rc.3 is outside it)
CVE-2025-71401
Affects 1.0.9-beta.3 to 1.4.2-beta.5 (1.4.2 is outside it)
CVE-2025-71399
Affects 1.0.9-beta.3 to 1.4.4 (1.4.5 is outside it)
CVE-2026-67336
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2026-67333
Affects 1.0.9-beta.3 to 1.6.12 (1.6.13 is outside it); 1.7.0-beta.0 to 1.7.0-beta.3 (1.7.0-beta.4 is outside it)
CVE-2026-67334
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2025-71403
Affects 1.0.9-beta.3 to 1.1.21-beta.1 (1.1.21 is outside it)
CVE-2026-67337
Affects 1.0.9-beta.3 to 1.4.9-beta.1 (1.4.9 is outside it)

Show all 27 advisoriesShow fewer advisories

CVE-2025-71404
Affects 1.0.9-beta.3 to 1.1.16-beta.10 (1.1.16 is outside it)
CVE-2026-67327
Affects 1.1.3 to 1.6.21 (1.6.22 is outside it); 1.7.0-beta.0 to 1.7.0-beta.9 (1.7.0-beta.10 is outside it)
CVE-2026-67335
Affects 1.0.9-beta.3 to 1.6.1 (1.6.2 is outside it)
CVE-2025-71402
Affects 1.3.34 to 1.4.0-beta.28 (1.4.0 is outside it)
CVE-2026-53517
Affects 1.4.8-beta.7 to 1.6.0-beta.0 (1.6.0 is outside it)
CVE-2026-45337
Affects 1.6.0 to 1.6.10 (1.6.11 is outside it)
CVE-2026-53514
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2026-53512
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2026-53518
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2026-53516
Affects 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it)
CVE-2026-45364
Affects 1.0.9-beta.3 to 1.4.16 (1.4.17 is outside it); 1.5.0-beta.1 to 1.5.0-beta.8 (1.5.0-beta.9 is outside it)
CVE-2025-61928
Affects 1.0.9-beta.3 to 1.3.25 (1.3.26 is outside it)
CVE-2025-53535
Affects 1.0.9-beta.3 to 1.2.10-beta.1 (1.2.10 is outside it)
CVE-2025-27143
Affects 1.0.9-beta.3 to 1.1.20-beta.5 (1.1.20 is outside it)
CVE-2024-56734
Affects 1.0.9-beta.3 to 1.1.5 (1.1.6 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 27

CVE-2026-114607Critical 9.1
better-auth: OAuth state can be used as a Magic Link to sign in as another user
Affected: from 1.4.0-beta.18, fixed in 1.7.7.
Fixed in 1.7.7 (released Sep 30, 2026, 22 days before disclosure).
The latest release, 1.7.18, is not affected.
40% of better-auth downloads last week were affected versions (7.5M).
CVE-2026-110864Critical 9.1
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Affected: from 1.5.0-beta.12, fixed in 1.7.7.
Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure).
The latest release, 1.7.18, is not affected.
37% of better-auth downloads last week were affected versions (7M).
CVE-2026-110862Critical 9.3
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Affected: from 1.4.0-beta.18, fixed in 1.7.7.
Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure).
The latest release, 1.7.18, is not affected.
40% of better-auth downloads last week were affected versions (7.5M).
CVE-2026-110861Medium 6.3
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
Affected: from 1.6.17, fixed in 1.7.7.
Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure).
The latest release, 1.7.18, is not affected.
32% of better-auth downloads last week were affected versions (6M).
CVE-2026-109346High 8.5
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
Affected: from 1.3.8-beta.3, fixed in 1.7.0-rc.3.
Fixed in 1.7.0-rc.3 (released Aug 3, 2026, 70 days before disclosure).
The latest release, 1.7.18, is not affected.
29% of better-auth downloads last week were affected versions (5.4M).
CVE-2025-71401Critical 9.3
better-auth before 1.4.2 basePath Modification DoS
Affected: fixed in 1.4.2.
Fixed in 1.4.2 (released Nov 25, 2025, 250 days before disclosure).
The latest release, 1.7.18, is not affected.
1.6% of better-auth downloads last week were affected versions (295.2K).
CVE-2025-71399High 8.8
Better Auth before 1.4.5 Path Normalization Bypass via rou3
Affected: fixed in 1.4.5.
Fixed in 1.4.5 (released Dec 3, 2025, 242 days before disclosure).
The latest release, 1.7.18, is not affected.
1.6% of better-auth downloads last week were affected versions (300.9K).
CVE-2026-67336Critical 9.4
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
Affected: fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 81 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2026-67333Medium 5.1
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
Affected: fixed in 1.6.13; from 1.7.0-beta.0, fixed in 1.7.0-beta.4.
Fixed in 1.6.13 (released May 31, 2026, 62 days before disclosure) and 1.7.0-beta.4 (released May 31, 2026, 62 days before disclosure).
The latest release, 1.7.18, is not affected.
8.5% of better-auth downloads last week were affected versions (1.6M).
CVE-2026-67334Medium 5.1
better-auth Stale Sessions Persist After User Deletion
Affected: from 0.3.4, fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 81 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2025-71403High 7.1
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
Affected: fixed in 1.1.21.
Fixed in 1.1.21 (released Feb 24, 2025, 523 days before disclosure).
The latest release, 1.7.18, is not affected.
<0.1% of better-auth downloads last week were affected versions (13.2K).
CVE-2026-67337High 7.1
better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
Affected: fixed in 1.4.9.
Fixed in 1.4.9 (released Dec 23, 2025, 221 days before disclosure).
The latest release, 1.7.18, is not affected.
1.9% of better-auth downloads last week were affected versions (355.3K).
CVE-2025-71404Medium 5.1
better-auth before 1.1.16 Reflected XSS via error parameter
Affected: from 0.0.2, fixed in 1.1.16.
Fixed in 1.1.16 (released Feb 5, 2025, 542 days before disclosure).
The latest release, 1.7.18, is not affected.
<0.1% of better-auth downloads last week were affected versions (11.2K).
CVE-2026-67327High 8.7
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
Affected: from 1.1.3, fixed in 1.6.22; from 1.7.0-beta.0, fixed in 1.7.0-beta.10.
Fixed in 1.6.22 (released Jun 26, 2026, 36 days before disclosure) and 1.7.0-beta.10 (released Jun 26, 2026, 36 days before disclosure).
The latest release, 1.7.18, is not affected.
10% of better-auth downloads last week were affected versions (2M).
CVE-2026-67335Medium 6.0
better-auth before 1.6.2 OAuth State Validation Bypass
Affected: fixed in 1.6.2.
Fixed in 1.6.2 (released Apr 9, 2026, 114 days before disclosure).
The latest release, 1.7.18, is not affected.
6% of better-auth downloads last week were affected versions (1.1M).

Show all 27 advisoriesShow fewer advisories

CVE-2025-71402Low 2.0
better-auth before 1.4.0 Session Revocation via Forged Cookie
Affected: from 1.3.34, fixed in 1.4.0.
Fixed in 1.4.0 (released Nov 22, 2025, 252 days before disclosure).
The latest release, 1.7.18, is not affected.
0.4% of better-auth downloads last week were affected versions (74.7K).
CVE-2026-53517High 8.1
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
Affected: from 1.4.8-beta.7, fixed in 1.6.0.
Fixed in 1.6.0 (released Apr 6, 2026, 100 days before disclosure).
The latest release, 1.7.18, is not affected.
4% of better-auth downloads last week were affected versions (764.6K).
CVE-2026-45337High 7.6
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Affected: from 1.6.0, fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure).
The latest release, 1.7.18, is not affected.
1.6% of better-auth downloads last week were affected versions (300.4K).
CVE-2026-53514High 7.7
Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
Affected: fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2026-53512Critical 9.1
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Affected: fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2026-53518High 7.6
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
Affected: fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2026-53516High 8.3
Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Affected: fixed in 1.6.11.
Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure).
The latest release, 1.7.18, is not affected.
7.5% of better-auth downloads last week were affected versions (1.4M).
CVE-2026-45364High 7.3
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Affected: fixed in 1.4.17; from 1.5.0-beta.1, fixed in 1.5.0-beta.9.
Fixed in 1.4.17 (released Jan 21, 2026, 127 days before disclosure) and 1.5.0-beta.9 (released Jan 21, 2026, 127 days before disclosure).
The latest release, 1.7.18, is not affected.
2.3% of better-auth downloads last week were affected versions (426.6K).
CVE-2025-61928Critical 9.3
Better Auth: Unauthenticated API key creation through api-key plugin
Affected: fixed in 1.3.26.
Fixed in 1.3.26 (released Oct 3, 2025, 6 days before disclosure).
The latest release, 1.7.18, is not affected.
0.7% of better-auth downloads last week were affected versions (130.6K).
CVE-2025-53535Low 2.1
Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
Affected: fixed in 1.2.10.
Fixed in 1.2.10 (released Jun 20, 2025, 17 days before disclosure).
The latest release, 1.7.18, is not affected.
0.2% of better-auth downloads last week were affected versions (43.7K).
CVE-2025-27143Medium 6.9
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Affected: fixed in 1.1.20.
Fixed in 1.1.20 (released Feb 24, 2025, the day of disclosure).
The latest release, 1.7.18, is not affected.
<0.1% of better-auth downloads last week were affected versions (13.1K).
CVE-2024-56734High 7.9
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
Affected: fixed in 1.1.6.
Fixed in 1.1.6 (released Dec 30, 2024, the day of disclosure).
The latest release, 1.7.18, is not affected.
<0.1% of better-auth downloads last week were affected versions (8.7K).