@better-auth Better Auth

• CVE-2026-121802 Critical 9.1 @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking 0.2%
• CVE-2026-114607 Critical 9.1 better-auth: OAuth state can be used as a Magic Link to sign in as another user 0.4%
• CVE-2026-110864 High 7.4 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy 0.3%
• CVE-2026-110862 Critical 9.1 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link 0.3%
• CVE-2026-110861 Low 3.7 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition 0.2%
• CVE-2026-109346 High 8.1 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device 0.3%
• CVE-2025-71401 Medium 5.9 better-auth before 1.4.2 basePath Modification DoS 0.5%
• CVE-2025-71399 High 8.6 Better Auth before 1.4.5 Path Normalization Bypass via rou3 0.5%
• CVE-2026-67336 High 8.7 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider 0.2%
• CVE-2026-67333 High 7.2 better-auth before 1.6.13 Stored XSS via javascript redirect_uri 0.3%
• CVE-2026-67334 Low 3.8 better-auth Stale Sessions Persist After User Deletion 0.3%
• CVE-2025-71403 High 7.1 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass 0.3%
• CVE-2026-67337 Medium 6.5 better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache 0.5%
• CVE-2025-71404 Medium 5.1 better-auth before 1.1.16 Reflected XSS via error parameter 0.7%
• CVE-2026-67327 High 8.3 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP 0.4%
• CVE-2026-67335 Medium 5.3 better-auth before 1.6.2 OAuth State Validation Bypass 0.3%
• CVE-2025-71402 Low 2.0 better-auth before 1.4.0 Session Revocation via Forged Cookie 0.3%
• CVE-2026-53517 High 8.1 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking 0.4%
• CVE-2026-45337 High 7.6 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending 0.2%
• CVE-2026-53514 High 7.7 Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin 0.2%
• CVE-2026-53515 High 7.1 Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso 0.4%
• CVE-2026-53512 Critical 9.1 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins 0.3%
• CVE-2026-53518 High 7.6 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption 0.4%
• CVE-2026-53513 Critical 9.6 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration 0.2%
• CVE-2026-53516 High 8.3 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email 0.3%
• CVE-2026-45364 High 7.3 Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation 0.3%
• CVE-2026-41427 High 7.1 Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients 0.2%
• CVE-2025-61928 Critical 9.3 Better Auth: Unauthenticated API key creation through api-key plugin 19.7%
• CVE-2025-53535 Low 2.1 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes 0.4%
• CVE-2025-27143 Medium 6.9 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter 0.4%
• CVE-2024-56734 High 7.9 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint 0.4%