Auth bypass in Better-auth
CVE-2026-53514
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabl…
Vulnerability class: Broken Authentication
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Better-auth — versions < 1.6.11
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-53514?
- CVE-2026-53514 is a high-severity vulnerability in Better-auth, classified under Improper Authentication. CVSS score: 7.7/10. Published 2026-07-15.
- How severe is CVE-2026-53514?
- High severity. CVSS v3 base score is 7.7 out of 10.