CVE-2025-71401 | Medium | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker a… |
CVE-2025-71400 | High | 7.1 | 2026-08-02 | better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated… |
CVE-2025-71399 | High | 8.6 | 2026-08-02 | Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path… |
CVE-2026-67337 | Medium | 6.5 | 2026-08-01 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary cr… |
CVE-2026-67336 | High | 8.7 | 2026-08-01 | better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept pla… |
CVE-2026-67335 | Medium | 5.3 | 2026-08-01 | better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Atta… |
CVE-2026-67334 | Low | 3.8 | 2026-08-01 | better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configur… |
CVE-2026-67333 | High | 7.2 | 2026-08-01 | better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated… |
CVE-2026-67332 | Medium | 6.4 | 2026-08-01 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelate… |
CVE-2026-67331 | High | 8.3 | 2026-08-01 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users… |
CVE-2026-67330 | Critical | 9.9 | 2026-08-01 | @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypas… |
CVE-2026-67329 | High | 7.1 | 2026-08-01 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription acti… |
CVE-2026-67328 | High | 8.1 | 2026-08-01 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbi… |
CVE-2026-67327 | High | 8.3 | 2026-08-01 | better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hi… |
CVE-2025-71404 | | | 2026-08-01 | better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value o… |
CVE-2025-71403 | High | 7.1 | 2026-08-01 | better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers ca… |
CVE-2025-71402 | | | 2026-08-01 | better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-se… |
CVE-2026-53518 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint… |
CVE-2026-53517 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token e… |
CVE-2026-53516 | High | 8.3 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo… |
CVE-2026-53515 | High | 7.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint… |
CVE-2026-53514 | High | 7.7 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside… |
CVE-2026-53513 | Critical | 9.6 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/upda… |
CVE-2026-53512 | Critical | 9.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoint… |
CVE-2026-45337 | High | 7.6 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated ses… |
CVE-2026-15527 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon… |
CVE-2026-45364 | High | 7.3 | 2026-05-28 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request… |
CVE-2026-41427 | Medium | 6.5 | 2026-04-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth… |
CVE-2025-61928 | | | 2025-10-09 | Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys… |
CVE-2025-53535 | | | 2025-07-07 | Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affect… |
CVE-2025-27143 | Medium | 6.1 | 2025-02-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to im… |
CVE-2024-56734 | Medium | 6.1 | 2024-12-30 | Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Bet… |