@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53513 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53513 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Am I affected? Users are affected if all of the following are true: - Their application uses @better-auth/sso at a version = 0.1.0, 1.6.11 on the stable line, or any 1.7.0-beta.x on the pre-release line. - The sso plugin is added to their application's betterAuth plugins: ... array. - Any user wi...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

GHSA-392P-2Q2V-4372 Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Am I affected? Users are affected if all of the following are true: - Their project depends on @better-auth/oauth-provider at a version = 1.6.0, = 1.4.8-beta.7, 1.6.0. - At least one OAuth client served by their application's authorization server requests the offlineaccess scope, so refresh token...

Insufficient Session Expiration

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Insufficient Session Expiration through the POST /oauth2/token endpoint during the refresh token granting. An attacker can gain unauthorized access by exploiting...

@agent-native/core (>=0.26.5, <=0.47.1), @automate.ax/components-core (>=0.1.3, <=0.3.1) +34 more potentially affected by CVE-2026-53517 via @better-auth/memory-adapter (>=1.6.0, <=1.6.10)

@better-auth/memory-adapter NPM version =1.6.0, =0.26.5, =0.1.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.11.3, =1.6.0-depup.0, =0.73.0, =0.73.0, =0.80.6 and more Source cves: CVE-2026-53517 Source advisory: SNYK:JS-BETTERAUTHMEMORYADAPTER-17889814...

NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption vulnerability discovered by ? in WordPress Npm better-auth versions = 1.4.8-beta.7, 1.6.0...

@agentcorporation/server (>=0.3.3, <=0.3.13), @agentuity/auth (>=1.0.35, <=3.0.0-alpha.6) +131 more potentially affected by CVE-2026-53517 via better-auth (>=1.4.8-beta.4, <=1.5.7-beta.1)

better-auth NPM version =1.4.8-beta.4, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.0.7, =1.4.21, =1.7.0, =2026.512.0-canary.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-53517 Source advisory: OSV:GHSA-392P-2Q2V-4372...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-67336 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-67336 Source advisory: OSV:GHSA-9H47-PQCX-HJR4...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889826...

GHSA-9H47-PQCX-HJR4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...

@access-dlsu/leapify (>=0.260531.1, <=0.260608.1), @agent-native/core (>=0.26.5, <=0.47.1) +218 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.6.12)

better-auth NPM version =1.0.0, =0.260531.1, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.1.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889822...

@access-dlsu/leapify (>=0.260531.1, <=0.260608.1), @agent-native/core (>=0.26.5, <=0.47.1) +218 more potentially affected by CVE-2026-67333 via better-auth (>=1.0.0, <=1.6.12)

better-auth NPM version =1.0.0, =0.260531.1, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.1.4 and more Source cves: CVE-2026-67333 Source advisory: OSV:GHSA-86J7-9J95-VPQJ...

GHSA-86J7-9J95-VPQJ Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

Authentication Bypass Using an Alternate Path or Channel

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the handleOAuthUserInfo. An attacker can gain unauthorized access to user accounts by...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53516 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: SNYK:JS-BETTERAUTH-17889818...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53516 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: OSV:GHSA-G38M-R43W-P2Q7...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +187 more potentially affected by CVE-2026-53516 via @better-auth/core (>=1.3.18, <=1.6.10)

@better-auth/core NPM version =1.3.18, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.3.18, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: SNYK:JS-BETTERAUTHCORE-17889819...