What’s Vulnerable › Products

better-auth vulnerabilities

29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your better-auth version is affected

Latest better-auth vulnerabilities

• CVE-2026-114607 — better-auth: OAuth state can be used as a Magic Link to sign in as another user (CVSS 9.1)
• CVE-2026-110864 — Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy (CVSS 7.4)
• CVE-2026-110862 — Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link (CVSS 9.1)
• CVE-2026-110861 — Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition (CVSS 3.7)
• CVE-2026-109346 — better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device (CVSS 8.1)
• CVE-2025-71401 — better-auth before 1.4.2 basePath Modification DoS (CVSS 5.9)
• CVE-2025-71399 — Better Auth before 1.4.5 Path Normalization Bypass via rou3 (CVSS 8.6)
• CVE-2026-67337 — better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache (CVSS 6.5)
• CVE-2026-67336 — better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider (CVSS 8.7)
• CVE-2026-67335 — better-auth before 1.6.2 OAuth State Validation Bypass (CVSS 5.3)
• CVE-2026-67334 — better-auth Stale Sessions Persist After User Deletion (CVSS 3.8)
• CVE-2026-67333 — better-auth before 1.6.13 Stored XSS via javascript redirect_uri (CVSS 7.2)
• CVE-2026-67327 — better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP (CVSS 8.3)
• CVE-2025-71404 — better-auth before 1.1.16 Reflected XSS via error parameter (CVSS 5.1)
• CVE-2025-71403 — better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass (CVSS 7.1)
• CVE-2025-71402 — better-auth before 1.4.0 Session Revocation via Forged Cookie (CVSS 2.0)
• CVE-2026-53518 — Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption (CVSS 8.1)
• CVE-2026-53517 — Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking (CVSS 8.1)
• CVE-2026-53516 — Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email (CVSS 8.3)
• CVE-2026-53515 — Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso (CVSS 7.1)
• CVE-2026-53514 — Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin (CVSS 7.7)
• CVE-2026-53513 — Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration (CVSS 9.6)
• CVE-2026-53512 — Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (CVSS 9.1)
• CVE-2026-45337 — Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending (CVSS 7.6)
• CVE-2026-45364 — Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation (CVSS 7.3)