Read the docs

better-auth

Records40All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high20CVSS 7.0–8.9

Exploited now

better-auth records in CISA KEV

No better-auth vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Better Auth 10 records HIGH Better-auth/oauth-provider 3 records LOW Better-auth/sso 2 records MEDIUM

Records

40 records

TI-2026-47627 CVE-2026-67331 · GHSA-gj37-5j8h-j367

better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

Priority HIGH 71

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00388 Published 2026-08-01 Fixed in 1.7.0-beta.4 CWE-639
TI-2026-74552 CVE-2026-110862

Authentication bypass in Better Auth Magic Link verification

Priority MEDIUM 48

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00321 Published 2026-10-14 Fixed in 1.7.7 CWE-287
TI-2026-84923 CVE-2026-121802 · GHSA-hv45-wgqh-c9j5

Unchecked state signing in @better-auth/expo enables account takeover

Priority MEDIUM 47

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00203 Published 2026-11-04 Fixed in 1.7.16 CWE-346
TI-2026-74554 CVE-2026-110864

Authentication bypass in Better Auth OAuth Proxy plugin allows account takeover

Priority MEDIUM 41

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00288 Published 2026-10-14 Fixed in 1.7.7 CWE-287
TI-2026-47632 CVE-2026-67336 · GHSA-mw34-3w2r-wp9p

better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Priority MEDIUM 40

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.00236 Published 2026-08-01 Fixed in 1.6.11 CWE-327
TI-2026-47624 CVE-2026-67328 · GHSA-8g2f-78cq-p655

@better-auth/sso before 1.6.21 Account Takeover via SSO

Priority MEDIUM 40

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00491 Published 2026-08-01 Fixed in 1.6.21, 1.7.0-beta.10 CWE-79
TI-2026-47623 CVE-2026-67327 · GHSA-9wm3-rh5c-fc37

better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

Priority MEDIUM 40

better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/p…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00429 Published 2026-08-01 Fixed in 1.6.22, 1.7.0-beta.10 CWE-287
TI-2025-43517 CVE-2025-71401 · GHSA-569q-mpph-wgww

better-auth before 1.4.2 basePath Modification DoS

Priority MEDIUM 40

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00455 Published 2026-08-02 Fixed in 1.4.2 CWE-770
TI-2026-74553 CVE-2026-110863

Authentication bypass in Better Auth SSO lets users sign in as others

Priority LOW 39

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-14 Fixed in 1.7.3 CWE-287
TI-2026-71162 CVE-2026-109346 · GHSA-v9c8-wq66-wf8g

UI misrepresentation in better-auth device flow enables phishing

Priority LOW 39

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00278 Published 2026-10-12 Fixed in 1.7.0-rc.3 CWE-451
TI-2026-55433 CVE-2026-80192 · GHSA-xfj7-7fp8-rhvp

better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

Priority LOW 39

@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00363 Published 2026-08-25 Fixed in 1.4.8, 1.6.27 +1 CWE-287
Load more
Open these records in search →