Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

better-auth — Vulnerabilities & Security Advisories 29

All 29 CVE vulnerabilities found in better-auth, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities associated with the open-source authentication library better-auth, focusing on common weakness categories such as authentication bypass, access control failures, and injection flaws. The collection covers historical security advisories and reported issues affecting various versions of the library, providing a comprehensive view of its security posture over time. By reviewing this data, users can track the vendor’s response patterns and advisory timelines, gain a deeper understanding of specific weakness classes relevant to authentication systems, and inspect the full vulnerability history of the product to assess risk exposure. This resource is designed for security professionals, developers, and auditors who need to evaluate the safety of integrating better-auth into their applications. It consolidates scattered reports into a single, accessible location to facilitate informed decision-making regarding patching strategies and mitigation efforts. The information presented here reflects publicly available data and is intended to support proactive security management rather than serve as an exhaustive record of all potential flaws. Users are encouraged to cross-reference this data with official documentation and recent advisories to ensure they have the most current threat intelligence. The page does not endorse any specific version or guarantee immunity to all attacks, but rather offers a structured overview of past and present vulnerabilities. This approach helps stakeholders understand the context of each issue, including severity ratings and impact scopes, allowing them to prioritize remediation tasks effectively. Ultimately, this aggregation aims to improve transparency and streamline the process of maintaining secure authentication implementations.

Vendor: better-auth

CVE ID Title CVSS Severity Published
CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user CWE-287 9.1 Critical 2026-10-22
CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy CWE-287 7.4 High 2026-10-14
CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link CWE-287 9.1 Critical 2026-10-14
CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device CWE-451 8.1 High 2026-10-12
CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS CWE-770 5.9 Medium 2026-08-02
CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3 CWE-20 8.6 High 2026-08-02
CVE-2026-67337 better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache CWE-288 6.5 Medium 2026-08-01
CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter CWE-79 5.1 Medium 2026-08-01
CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass CWE-601 7.1 High 2026-08-01
CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion CWE-459 3.8 Low 2026-08-01
CVE-2026-67333 better-auth before 1.6.13 Stored XSS via javascript redirect_uri CWE-79 7.2 High 2026-08-01
CVE-2026-67336 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider CWE-327 8.7 High 2026-08-01
CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP CWE-287 8.3 High 2026-08-01
CVE-2026-67335 better-auth before 1.6.2 OAuth State Validation Bypass CWE-287 5.3 Medium 2026-08-01
CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie CWE-347 2.0 Low 2026-08-01
CVE-2026-53517 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking CWE-362 8.1 High 2026-07-15
CVE-2026-45337 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending CWE-285 7.6 High 2026-07-15
CVE-2026-53514 Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin CWE-287 7.7 High 2026-07-15
CVE-2026-53515 Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso CWE-269 7.1 High 2026-07-15
CVE-2026-53512 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CWE-287 - - 2026-07-15
CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption CWE-362 - - 2026-07-15
CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration CWE-20 9.6 Critical 2026-07-15
CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email CWE-287 8.3 High 2026-07-15
CVE-2026-45364 Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation CWE-307 7.3 High 2026-05-28
CVE-2026-41427 Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients CWE-863 4.3AI Medium AI 2026-04-24
CVE-2025-61928 Better Auth: Unauthenticated API key creation through api-key plugin CWE-285 7.5AI High AI 2025-10-09
CVE-2025-53535 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes CWE-601 6.1AI Medium AI 2025-07-07
CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CWE-601 6.1 - 2025-02-24
CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint CWE-601 6.1 - 2024-12-30

All 29 known CVE vulnerabilities affecting better-auth with full Chinese analysis, references, and POCs where available.