CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67333

CVE-2026-67333 concerns the app/tooling package better-auth (versions before 1.6.13 and pre-release 1.7.0-beta.0–beta.3) and incorrect validation of the scheme for redirect_uris registered via the deprecated oidc-provider and the wrapped mcp plugin. An attacker can register an OAuth client with a...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +163 more potentially affected by CVE-2026-67333 via better-auth (>=0.4.9-beta.7, <=1.6.12)

better-auth NPM version =0.4.9-beta.7, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.0.1, =1.2.5, =1.9.7 and more Source cves: CVE-2026-67333 Source advisory: MEND:CVE-2026-67333...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +148 more potentially affected by CVE-2026-67336 via better-auth (>=0.4.9-beta.7, <=1.6.10)

better-auth NPM version =0.4.9-beta.7, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.0.1, =1.2.5, =1.9.7 and more Source cves: CVE-2026-67336 Source advisory: MEND:CVE-2026-67336...

CVE-2025-71403

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67336

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...

CVE-2026-67333 better-auth before 1.6.13 Stored XSS via javascript redirect_uri

better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...

CVE-2026-67333 better-auth before 1.6.13 Stored XSS via javascript redirect_uri

better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

auth (>=1.7.0-beta.0, <=1.7.0-beta.3) potentially affected by CVE-2026-67333 via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.3)

better-auth NPM version =1.7.0-beta.0, =1.7.0-beta.0, =1.7.0-beta.3 Source cves: CVE-2026-67333 Source advisory: MEND:CVE-2026-67333...

CVE-2026-67332

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +148 more potentially affected by CVE-2026-67334 via better-auth (>=0.4.9-beta.7, <=1.6.10)

better-auth NPM version =0.4.9-beta.7, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =0.0.1, =1.2.5, =1.9.7 and more Source cves: CVE-2026-67334 Source advisory: MEND:CVE-2026-67334...

CVE-2026-67337 better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

CVE-2026-67335

Affected software: better-auth before 1.6.2. Vulnerability: OAuth state validation failure due to cookie-backed state storage without PKCE, allowing attackers to forge the state and supply an attacker-controlled authorization code. Impact: can create authenticated sessions bound to the attacker's...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...