better-auth v1.7.7 Security Advisory: Magic Link Signature & OAuth Vulnerabilities Fixed

Vulnerability Overview Magic Link Signature Vulnerability: Upgraded the shared verification store to support new Magic Links and regenerated OAuth/SAML signatures. Social Provider Signature Issue: Fixed social provider signature issues. OAuth Error State: Fixed the issue where OAuth error states were treated as provider profiles. OAuth Participant Upgrade: Upgraded all OAuth participants to support new evidence. CAPTCHA Error: Fixed CAPTCHA errors that resulted in 200 status codes and empty responses. Organization Refresh Failure: Fixed the issue where active organizations failed to refresh when selecting the initial organization in session hooks. Rate Limiting Error: Fixed rate limiting errors that returned 200 status codes and empty responses. Concurrent PostgreSQL Queries: Fixed the issue where concurrent PostgreSQL queries exceeded the database lock timeout. Concurrent Writes Invalidating Original Documents: Fixed the issue where concurrent writes during record deletion invalidated the original document. Scope of Impact better-auth: Affected components include , , , and . Version: v1.7.7 Remediation Upgrade Shared Verification Store: Upgrade the shared verification store to support new Magic Links. Regenerate Signatures: Regenerate OAuth/SAML signatures. Fix Social Provider Signatures: Address social provider signature issues. Fix OAuth Error State: Resolve the issue where OAuth error states were treated as provider profiles. Upgrade OAuth Participants: Upgrade all OAuth participants to support new evidence. Fix CAPTCHA Errors: Resolve CAPTCHA errors resulting in 200 status codes and empty responses. Fix Organization Refresh Failures: Resolve issues where active organizations failed to refresh when selecting the initial organization in session hooks. Fix Rate Limiting Errors: Resolve rate limiting errors returning 200 status codes and empty responses. Fix Concurrent PostgreSQL Queries: Resolve issues where concurrent PostgreSQL queries exceeded the database lock timeout. Fix Concurrent Writes Invalidating Original Documents: Resolve issues where concurrent writes during record deletion invalidated the original document. POC or Exploit Code No POC or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

better-auth v1.7.7 Security Advisory: Magic Link Signature & OAuth Vulnerabilities Fixed

More from this source