Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: better-auth 1.7.7 Clear all filters
TI-2026-74554 CVE-2026-110864

Authentication bypass in Better Auth OAuth Proxy plugin allows account takeover

Priority MEDIUM 41

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00288 Published 2026-10-14 Fixed in 1.7.7 CWE-287
TI-2026-74552 CVE-2026-110862

Authentication bypass in Better Auth Magic Link verification

Priority MEDIUM 48

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00321 Published 2026-10-14 Fixed in 1.7.7 CWE-287
TI-2026-74551 CVE-2026-110861

Race condition in Better Auth rate limiting allows limit bypass

Priority LOW 27

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where t…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00217 Published 2026-10-14 Fixed in 1.7.7, 1.7.0 CWE-307