Better-auth vulnerabilities
40 CVEs and advisories name Better-auth as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-53518Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
- CVE-2026-53513Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
- CVE-2026-53516Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
- CVE-2026-15527better-auth better-icons scan_project_icons/sync_icon path traversal
- CVE-2026-45364Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
- CVE-2026-41427Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
- CVE-2025-61928Better Auth: Unauthenticated API key creation through api-key plugin
- CVE-2025-53535Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
- CVE-2025-27143Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
- CVE-2024-56734Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint