Better-auth vulnerabilities
40 CVEs and advisories name Better-auth as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121802@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address)…
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another user
- CVE-2026-110864Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
- CVE-2026-110863Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
- CVE-2026-110862Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
- CVE-2026-110861Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
- CVE-2026-109346better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
- CVE-2026-80192better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
- CVE-2025-71401better-auth before 1.4.2 basePath Modification DoS
- CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkey
- CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3
- CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
- CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_uri
- CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
- CVE-2026-67334better-auth Stale Sessions Persist After User Deletion
- CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
- CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
- CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
- CVE-2026-67328@better-auth/sso before 1.6.21 Account Takeover via SSO
- CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameter
- CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
- CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
- CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypass
- CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
- CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookie
- CVE-2026-53517Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
- CVE-2026-45337Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
- CVE-2026-53514Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
- CVE-2026-53515Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
- CVE-2026-53512Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins