# better-auth (npm) vulnerabilities 27 known vulnerabilities (7 critical, 12 high, 6 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.7.18 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 1.7.18 (Nov 5, 2026), the latest release - Weekly downloads: 17.1M - Releases: 500+ since 1.0.9 (Dec 3, 2024) - Registry: https://www.npmjs.com/package/better-auth - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114607: 1.4.0-beta.18 to 1.7.6 (1.7.7 is outside it) - CVE-2026-110864: 1.5.0-beta.12 to 1.7.6 (1.7.7 is outside it) - CVE-2026-110862: 1.4.0-beta.18 to 1.7.6 (1.7.7 is outside it) - CVE-2026-110861: 1.6.17 to 1.7.6 (1.7.7 is outside it) - CVE-2026-109346: 1.3.8-beta.3 to 1.7.0-rc.2 (1.7.0-rc.3 is outside it) - CVE-2025-71401: 1.0.9-beta.3 to 1.4.2-beta.5 (1.4.2 is outside it) - CVE-2025-71399: 1.0.9-beta.3 to 1.4.4 (1.4.5 is outside it) - CVE-2026-67336: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2026-67333: 1.0.9-beta.3 to 1.6.12 (1.6.13 is outside it); 1.7.0-beta.0 to 1.7.0-beta.3 (1.7.0-beta.4 is outside it) - CVE-2026-67334: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2025-71403: 1.0.9-beta.3 to 1.1.21-beta.1 (1.1.21 is outside it) - CVE-2026-67337: 1.0.9-beta.3 to 1.4.9-beta.1 (1.4.9 is outside it) - CVE-2025-71404: 1.0.9-beta.3 to 1.1.16-beta.10 (1.1.16 is outside it) - CVE-2026-67327: 1.1.3 to 1.6.21 (1.6.22 is outside it); 1.7.0-beta.0 to 1.7.0-beta.9 (1.7.0-beta.10 is outside it) - CVE-2026-67335: 1.0.9-beta.3 to 1.6.1 (1.6.2 is outside it) - CVE-2025-71402: 1.3.34 to 1.4.0-beta.28 (1.4.0 is outside it) - CVE-2026-53517: 1.4.8-beta.7 to 1.6.0-beta.0 (1.6.0 is outside it) - CVE-2026-45337: 1.6.0 to 1.6.10 (1.6.11 is outside it) - CVE-2026-53514: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2026-53512: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2026-53518: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2026-53516: 1.0.9-beta.3 to 1.6.10 (1.6.11 is outside it) - CVE-2026-45364: 1.0.9-beta.3 to 1.4.16 (1.4.17 is outside it); 1.5.0-beta.1 to 1.5.0-beta.8 (1.5.0-beta.9 is outside it) - CVE-2025-61928: 1.0.9-beta.3 to 1.3.25 (1.3.26 is outside it) - CVE-2025-53535: 1.0.9-beta.3 to 1.2.10-beta.1 (1.2.10 is outside it) - CVE-2025-27143: 1.0.9-beta.3 to 1.1.20-beta.5 (1.1.20 is outside it) - CVE-2024-56734: 1.0.9-beta.3 to 1.1.5 (1.1.6 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (27) ### [CVE-2026-114607](https://cve.now/CVE-2026-114607): better-auth: OAuth state can be used as a Magic Link to sign in as another user - Severity: Critical 9.1 - Published: Oct 22, 2026 - Affected: from 1.4.0-beta.18, fixed in 1.7.7. - Fixed in 1.7.7 (released Sep 30, 2026, 22 days before disclosure). - The latest release, 1.7.18, is not affected. - 40% of better-auth downloads last week were affected versions (7.5M). ### [CVE-2026-110864](https://cve.now/CVE-2026-110864): Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy - Severity: Critical 9.1 - Published: Oct 14, 2026 - Affected: from 1.5.0-beta.12, fixed in 1.7.7. - Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure). - The latest release, 1.7.18, is not affected. - 37% of better-auth downloads last week were affected versions (7M). ### [CVE-2026-110862](https://cve.now/CVE-2026-110862): Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link - Severity: Critical 9.3 - Published: Oct 14, 2026 - Affected: from 1.4.0-beta.18, fixed in 1.7.7. - Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure). - The latest release, 1.7.18, is not affected. - 40% of better-auth downloads last week were affected versions (7.5M). ### [CVE-2026-110861](https://cve.now/CVE-2026-110861): Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition - Severity: Medium 6.3 - Published: Oct 14, 2026 - Affected: from 1.6.17, fixed in 1.7.7. - Fixed in 1.7.7 (released Sep 30, 2026, 14 days before disclosure). - The latest release, 1.7.18, is not affected. - 32% of better-auth downloads last week were affected versions (6M). ### [CVE-2026-109346](https://cve.now/CVE-2026-109346): better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device - Severity: High 8.5 - Published: Oct 12, 2026 - Affected: from 1.3.8-beta.3, fixed in 1.7.0-rc.3. - Fixed in 1.7.0-rc.3 (released Aug 3, 2026, 70 days before disclosure). - The latest release, 1.7.18, is not affected. - 29% of better-auth downloads last week were affected versions (5.4M). ### [CVE-2025-71401](https://cve.now/CVE-2025-71401): better-auth before 1.4.2 basePath Modification DoS - Severity: Critical 9.3 - Published: Aug 2, 2026 - Affected: fixed in 1.4.2. - Fixed in 1.4.2 (released Nov 25, 2025, 250 days before disclosure). - The latest release, 1.7.18, is not affected. - 1.6% of better-auth downloads last week were affected versions (295.2K). ### [CVE-2025-71399](https://cve.now/CVE-2025-71399): Better Auth before 1.4.5 Path Normalization Bypass via rou3 - Severity: High 8.8 - Published: Aug 2, 2026 - Affected: fixed in 1.4.5. - Fixed in 1.4.5 (released Dec 3, 2025, 242 days before disclosure). - The latest release, 1.7.18, is not affected. - 1.6% of better-auth downloads last week were affected versions (300.9K). ### [CVE-2026-67336](https://cve.now/CVE-2026-67336): better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider - Severity: Critical 9.4 - Published: Aug 1, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 81 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2026-67333](https://cve.now/CVE-2026-67333): better-auth before 1.6.13 Stored XSS via javascript redirect\_uri - Severity: Medium 5.1 - Published: Aug 1, 2026 - Affected: fixed in 1.6.13; from 1.7.0-beta.0, fixed in 1.7.0-beta.4. - Fixed in 1.6.13 (released May 31, 2026, 62 days before disclosure) and 1.7.0-beta.4 (released May 31, 2026, 62 days before disclosure). - The latest release, 1.7.18, is not affected. - 8.5% of better-auth downloads last week were affected versions (1.6M). ### [CVE-2026-67334](https://cve.now/CVE-2026-67334): better-auth Stale Sessions Persist After User Deletion - Severity: Medium 5.1 - Published: Aug 1, 2026 - Affected: from 0.3.4, fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 81 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2025-71403](https://cve.now/CVE-2025-71403): better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass - Severity: High 7.1 - Published: Aug 1, 2026 - Affected: fixed in 1.1.21. - Fixed in 1.1.21 (released Feb 24, 2025, 523 days before disclosure). - The latest release, 1.7.18, is not affected. - <0.1% of better-auth downloads last week were affected versions (13.2K). ### [CVE-2026-67337](https://cve.now/CVE-2026-67337): better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache - Severity: High 7.1 - Published: Aug 1, 2026 - Affected: fixed in 1.4.9. - Fixed in 1.4.9 (released Dec 23, 2025, 221 days before disclosure). - The latest release, 1.7.18, is not affected. - 1.9% of better-auth downloads last week were affected versions (355.3K). ### [CVE-2025-71404](https://cve.now/CVE-2025-71404): better-auth before 1.1.16 Reflected XSS via error parameter - Severity: Medium 5.1 - Published: Aug 1, 2026 - Affected: from 0.0.2, fixed in 1.1.16. - Fixed in 1.1.16 (released Feb 5, 2025, 542 days before disclosure). - The latest release, 1.7.18, is not affected. - <0.1% of better-auth downloads last week were affected versions (11.2K). ### [CVE-2026-67327](https://cve.now/CVE-2026-67327): better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP - Severity: High 8.7 - Published: Aug 1, 2026 - Affected: from 1.1.3, fixed in 1.6.22; from 1.7.0-beta.0, fixed in 1.7.0-beta.10. - Fixed in 1.6.22 (released Jun 26, 2026, 36 days before disclosure) and 1.7.0-beta.10 (released Jun 26, 2026, 36 days before disclosure). - The latest release, 1.7.18, is not affected. - 10% of better-auth downloads last week were affected versions (2M). ### [CVE-2026-67335](https://cve.now/CVE-2026-67335): better-auth before 1.6.2 OAuth State Validation Bypass - Severity: Medium 6.0 - Published: Aug 1, 2026 - Affected: fixed in 1.6.2. - Fixed in 1.6.2 (released Apr 9, 2026, 114 days before disclosure). - The latest release, 1.7.18, is not affected. - 6% of better-auth downloads last week were affected versions (1.1M). ### [CVE-2025-71402](https://cve.now/CVE-2025-71402): better-auth before 1.4.0 Session Revocation via Forged Cookie - Severity: Low 2.0 - Published: Aug 1, 2026 - Affected: from 1.3.34, fixed in 1.4.0. - Fixed in 1.4.0 (released Nov 22, 2025, 252 days before disclosure). - The latest release, 1.7.18, is not affected. - 0.4% of better-auth downloads last week were affected versions (74.7K). ### [CVE-2026-53517](https://cve.now/CVE-2026-53517): Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking - Severity: High 8.1 - Published: Jul 15, 2026 - Affected: from 1.4.8-beta.7, fixed in 1.6.0. - Fixed in 1.6.0 (released Apr 6, 2026, 100 days before disclosure). - The latest release, 1.7.18, is not affected. - 4% of better-auth downloads last week were affected versions (764.6K). ### [CVE-2026-45337](https://cve.now/CVE-2026-45337): Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending - Severity: High 7.6 - Published: Jul 15, 2026 - Affected: from 1.6.0, fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure). - The latest release, 1.7.18, is not affected. - 1.6% of better-auth downloads last week were affected versions (300.4K). ### [CVE-2026-53514](https://cve.now/CVE-2026-53514): Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin - Severity: High 7.7 - Published: Jul 15, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2026-53512](https://cve.now/CVE-2026-53512): Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins - Severity: Critical 9.1 - Published: Jul 15, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2026-53518](https://cve.now/CVE-2026-53518): Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption - Severity: High 7.6 - Published: Jul 15, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2026-53516](https://cve.now/CVE-2026-53516): Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email - Severity: High 8.3 - Published: Jul 15, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released May 12, 2026, 64 days before disclosure). - The latest release, 1.7.18, is not affected. - 7.5% of better-auth downloads last week were affected versions (1.4M). ### [CVE-2026-45364](https://cve.now/CVE-2026-45364): Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation - Severity: High 7.3 - Published: May 28, 2026 - Affected: fixed in 1.4.17; from 1.5.0-beta.1, fixed in 1.5.0-beta.9. - Fixed in 1.4.17 (released Jan 21, 2026, 127 days before disclosure) and 1.5.0-beta.9 (released Jan 21, 2026, 127 days before disclosure). - The latest release, 1.7.18, is not affected. - 2.3% of better-auth downloads last week were affected versions (426.6K). ### [CVE-2025-61928](https://cve.now/CVE-2025-61928): Better Auth: Unauthenticated API key creation through api-key plugin - Severity: Critical 9.3 - Published: Oct 9, 2025 - Affected: fixed in 1.3.26. - Fixed in 1.3.26 (released Oct 3, 2025, 6 days before disclosure). - The latest release, 1.7.18, is not affected. - 0.7% of better-auth downloads last week were affected versions (130.6K). ### [CVE-2025-53535](https://cve.now/CVE-2025-53535): Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes - Severity: Low 2.1 - Published: Jul 7, 2025 - Affected: fixed in 1.2.10. - Fixed in 1.2.10 (released Jun 20, 2025, 17 days before disclosure). - The latest release, 1.7.18, is not affected. - 0.2% of better-auth downloads last week were affected versions (43.7K). ### [CVE-2025-27143](https://cve.now/CVE-2025-27143): Beter Auth has an Open Redirect via Scheme-Less Callback Parameter - Severity: Medium 6.9 - Published: Feb 24, 2025 - Affected: fixed in 1.1.20. - Fixed in 1.1.20 (released Feb 24, 2025, the day of disclosure). - The latest release, 1.7.18, is not affected. - <0.1% of better-auth downloads last week were affected versions (13.1K). ### [CVE-2024-56734](https://cve.now/CVE-2024-56734): Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint - Severity: High 7.9 - Published: Dec 30, 2024 - Affected: fixed in 1.1.6. - Fixed in 1.1.6 (released Dec 30, 2024, the day of disclosure). - The latest release, 1.7.18, is not affected. - <0.1% of better-auth downloads last week were affected versions (8.7K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/better-auth Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.