Vulnerabilities

TI-2026-38591 CVE-2026-53517 · GHSA-392p-2q2v-4372

Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

LOW 38

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00422 Published 2026-07-15 Fixed in 1.6.0, 1.6.11 CWE-362

TI-2026-33133 CVE-2026-45337 · GHSA-cq3f-vc6p-68fh

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

LOW 35

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00214 Published 2026-07-15 Fixed in 1.6.11 CWE-285

TI-2026-38588 CVE-2026-53514 · GHSA-fmh4-wcc4-5jm3

Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

LOW 35

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00201 Published 2026-07-15 Fixed in 1.6.11 CWE-287

TI-2026-38589 CVE-2026-53515 · GHSA-gv74-j8m3-fg5f

Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso

LOW 32

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00426 Published 2026-07-15 Fixed in 1.6.11 CWE-269

TI-2026-38586 CVE-2026-53512 · GHSA-pw9m-5jxm-xr6h

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

MEDIUM 47

Better Auth is an authentication and authorization library for TypeScript.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00275 Published 2026-07-15 Fixed in 1.6.11 CWE-287

TI-2026-38592 CVE-2026-53518 · GHSA-7w99-5wm4-3g79

Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption

LOW 35

Better Auth is an authentication and authorization library for TypeScript.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00409 Published 2026-07-15 Fixed in 1.6.11 CWE-362

TI-2026-38587 CVE-2026-53513 · GHSA-5rr4-8452-hf4v

Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

MEDIUM 42

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00248 Published 2026-07-15 Fixed in 1.6.11 CWE-20

TI-2026-38590 CVE-2026-53516 · GHSA-g38m-r43w-p2q7

Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email

LOW 38

Better Auth is an authentication and authorization library for TypeScript.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00289 Published 2026-07-15 Fixed in 1.6.11 CWE-287

TI-2025-20000 CVE-2025-27143 · GHSA-hjpm-7mrm-26w8

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

HIGH 70

Better Auth is an authentication and authorization library for TypeScript.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0035 Published 2025-02-24 Fixed in 1.1.20 CWE-601

TI-2024-37618 CVE-2024-56734 · GHSA-8jhw-6pjj-8723

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

LOW 35

Better Auth is an authentication library for TypeScript.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00387 Published 2024-12-30 Fixed in 1.1.5, 1.1.6 CWE-601

Vulnerabilities

Filters