Log in Start free

@better-auth

Products

ProductCVEsExploitedLatest
Better Auth31–Nov 4, 2026
sso5–Oct 14, 2026
oauth-provider3–Aug 1, 2026
scim2–Aug 1, 2026
kysely-adapter1–Oct 14, 2026
drizzle-adapter1–Oct 14, 2026
passkey1–Aug 2, 2026
better-icons1–Jul 13, 2026
stripe1–Aug 1, 2026

Exploited and recent CVEs

  • CVE-2026-121802 Critical 9.1 @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking 0.2%
  • CVE-2026-114607 Critical 9.1 better-auth: OAuth state can be used as a Magic Link to sign in as another user 0.4%
  • CVE-2026-110864 High 7.4 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy 0.3%
  • CVE-2026-110863 High 8.1 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers 0.3%
  • CVE-2026-110862 Critical 9.1 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link 0.3%
  • CVE-2026-110861 Low 3.7 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 0.2%
  • CVE-2026-110861 Low 3.7 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 0.2%
  • CVE-2026-110861 Low 3.7 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 0.2%
  • CVE-2026-109346 High 8.1 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device 0.3%
  • CVE-2026-80192 High 8.1 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass 0.4%
  • CVE-2025-71401 Medium 5.9 better-auth before 1.4.2 basePath Modification DoS 0.5%
  • CVE-2025-71400 High 7.1 better-auth passkey before 1.4.0 IDOR via delete-passkey 0.4%
  • CVE-2025-71399 High 8.6 Better Auth before 1.4.5 Path Normalization Bypass via rou3 0.5%
  • CVE-2026-67336 High 8.7 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider 0.2%
  • CVE-2026-67333 High 7.2 better-auth before 1.6.13 Stored XSS via javascript redirect_uri 0.3%
  • CVE-2026-67329 High 7.1 @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription 0.3%
  • CVE-2026-67334 Low 3.8 better-auth Stale Sessions Persist After User Deletion 0.3%
  • CVE-2025-71403 High 7.1 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass 0.3%
  • CVE-2026-67332 Medium 6.4 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass 0.3%
  • CVE-2026-67337 Medium 6.5 better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache 0.5%
  • CVE-2026-67328 High 8.1 @better-auth/sso before 1.6.21 Account Takeover via SSO 0.5%
  • CVE-2025-71404 Medium 5.1 better-auth before 1.1.16 Reflected XSS via error parameter 0.7%
  • CVE-2026-67327 High 8.3 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP 0.4%
  • CVE-2026-67331 High 8.3 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass 0.4%
  • CVE-2026-67335 Medium 5.3 better-auth before 1.6.2 OAuth State Validation Bypass 0.3%
  • CVE-2026-67330 Critical 9.9 better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision 0.6%
  • CVE-2025-71402 Low 2.0 better-auth before 1.4.0 Session Revocation via Forged Cookie 0.3%
  • CVE-2026-53517 High 8.1 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking 0.4%
  • CVE-2026-53517 High 8.1 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking 0.4%
  • CVE-2026-45337 High 7.6 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending 0.2%