Skip to content
OpenAdvisories

Vendor

better-auth

40 known vulnerabilities.

Products

better-auth 31 sso 5 oauth-provider 3 scim 2 stripe 1 drizzle-adapter 1 kysely-adapter 1 better-icons 1 passkey 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-121802

    @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account'…

    better-auth better-auth
  • Critical 9.1
    CVE-2026-114607

    better-auth: OAuth state can be used as a Magic Link to sign in as another user

    Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting al…

    better-auth better-auth
  • Critical 9.1
    CVE-2026-110862

    Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

    Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim'…

    better-auth better-auth better-auth npm
  • Critical 9.9
    CVE-2026-67330

    better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

    @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic…

    better-auth scim @better-auth/scim npm
  • Critical 9.1
    CVE-2026-53512

    Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching…

    better-auth better-auth better-auth npm
  • Critical 9.6
    CVE-2026-53513

    Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwk…

    better-auth better-auth sso @better-auth/sso npm
  • Critical 9.3
    CVE-2025-61928 EPSS 20%

    Better Auth: Unauthenticated API key creation through api-key plugin

    Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. …

    better-auth better-auth better-auth npm