# cve.now: Better-auth

The newest entries naming Better-auth as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121802](https://cve.now/CVE-2026-121802.md): @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address)… (CVSS 9.1)
- [CVE-2026-114607](https://cve.now/CVE-2026-114607.md): better-auth: OAuth state can be used as a Magic Link to sign in as another user (CVSS 9.1)
- [CVE-2026-110864](https://cve.now/CVE-2026-110864.md): Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy (CVSS 9.1)
- [CVE-2026-110863](https://cve.now/CVE-2026-110863.md): Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers (CVSS 8.6)
- [CVE-2026-110862](https://cve.now/CVE-2026-110862.md): Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link (CVSS 9.3)
- [CVE-2026-110861](https://cve.now/CVE-2026-110861.md): Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition (CVSS 6.3)
- [CVE-2026-109346](https://cve.now/CVE-2026-109346.md): better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device (CVSS 8.5)
- [CVE-2026-80192](https://cve.now/CVE-2026-80192.md): better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass (CVSS 8.6)
- [CVE-2025-71401](https://cve.now/CVE-2025-71401.md): better-auth before 1.4.2 basePath Modification DoS (CVSS 9.3)
- [CVE-2025-71400](https://cve.now/CVE-2025-71400.md): better-auth passkey before 1.4.0 IDOR via delete-passkey (CVSS 7.1)
- [CVE-2025-71399](https://cve.now/CVE-2025-71399.md): Better Auth before 1.4.5 Path Normalization Bypass via rou3 (CVSS 8.8)
- [CVE-2026-67336](https://cve.now/CVE-2026-67336.md): better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider (CVSS 9.4)
- [CVE-2026-67333](https://cve.now/CVE-2026-67333.md): better-auth before 1.6.13 Stored XSS via javascript redirect\_uri (CVSS 5.1)
- [CVE-2026-67329](https://cve.now/CVE-2026-67329.md): @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription (CVSS 7.1)
- [CVE-2026-67334](https://cve.now/CVE-2026-67334.md): better-auth Stale Sessions Persist After User Deletion (CVSS 5.1)
- [CVE-2025-71403](https://cve.now/CVE-2025-71403.md): better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass (CVSS 7.1)
- [CVE-2026-67332](https://cve.now/CVE-2026-67332.md): @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass (CVSS 5.3)
- [CVE-2026-67337](https://cve.now/CVE-2026-67337.md): better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache (CVSS 7.1)
- [CVE-2026-67328](https://cve.now/CVE-2026-67328.md): @better-auth/sso before 1.6.21 Account Takeover via SSO (CVSS 8.6)
- [CVE-2025-71404](https://cve.now/CVE-2025-71404.md): better-auth before 1.1.16 Reflected XSS via error parameter (CVSS 5.1)
- [CVE-2026-67327](https://cve.now/CVE-2026-67327.md): better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP (CVSS 8.7)
- [CVE-2026-67331](https://cve.now/CVE-2026-67331.md): better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass (CVSS 8.7)
- [CVE-2026-67335](https://cve.now/CVE-2026-67335.md): better-auth before 1.6.2 OAuth State Validation Bypass (CVSS 6.0)
- [CVE-2026-67330](https://cve.now/CVE-2026-67330.md): better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision (CVSS 9.4)
- [CVE-2025-71402](https://cve.now/CVE-2025-71402.md): better-auth before 1.4.0 Session Revocation via Forged Cookie (CVSS 2.0)
- [CVE-2026-53517](https://cve.now/CVE-2026-53517.md): Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking (CVSS 8.1)
- [CVE-2026-45337](https://cve.now/CVE-2026-45337.md): Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending (CVSS 7.6)
- [CVE-2026-53514](https://cve.now/CVE-2026-53514.md): Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin (CVSS 7.7)
- [CVE-2026-53515](https://cve.now/CVE-2026-53515.md): Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso (CVSS 7.1)
- [CVE-2026-53512](https://cve.now/CVE-2026-53512.md): Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (CVSS 9.1)
- [CVE-2026-53518](https://cve.now/CVE-2026-53518.md): Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption (CVSS 7.6)
- [CVE-2026-53513](https://cve.now/CVE-2026-53513.md): Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration (CVSS 9.6)
- [CVE-2026-53516](https://cve.now/CVE-2026-53516.md): Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email (CVSS 8.3)
- [CVE-2026-15527](https://cve.now/CVE-2026-15527.md): better-auth better-icons scan\_project\_icons/sync\_icon path traversal (CVSS 4.8)
- [CVE-2026-45364](https://cve.now/CVE-2026-45364.md): Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation (CVSS 7.3)
- [CVE-2026-41427](https://cve.now/CVE-2026-41427.md): Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients (CVSS 7.1)
- [CVE-2025-61928](https://cve.now/CVE-2025-61928.md): Better Auth: Unauthenticated API key creation through api-key plugin (CVSS 9.3)
- [CVE-2025-53535](https://cve.now/CVE-2025-53535.md): Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes (CVSS 2.1)
- [CVE-2025-27143](https://cve.now/CVE-2025-27143.md): Beter Auth has an Open Redirect via Scheme-Less Callback Parameter (CVSS 6.9)
- [CVE-2024-56734](https://cve.now/CVE-2024-56734.md): Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint (CVSS 7.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/better-auth
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.