Skip to content
OpenAdvisories

Package · npm

better-auth

26 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-110862

    Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

    Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim'…

    better-auth better-auth better-auth npm
  • Critical 9.1
    CVE-2026-53512

    Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching…

    better-auth better-auth better-auth npm
  • Critical 9.3
    CVE-2025-61928 EPSS 20%

    Better Auth: Unauthenticated API key creation through api-key plugin

    Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. …

    better-auth better-auth better-auth npm