NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption vulnerability discovered by ? in WordPress Npm better-auth versions = 1.4.8-beta.7, 1.6.0...

@inkeep/agents-api (>=0.73.0, <=0.80.7), @inkeep/agents-cli (>=0.73.0, <=0.80.7) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.7 Source cves:...

@inkeep/agents-api (>=0.73.0, <=0.80.7), @inkeep/agents-cli (>=0.73.0, <=0.80.7) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.7 Source cves:...

Insufficient Session Expiration

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Insufficient Session Expiration through the POST /oauth2/token endpoint during the refresh token granting. An attacker can gain unauthorized access by exploiting...

@agentcorporation/server (>=0.3.3, <=0.3.13), @agentuity/auth (>=1.0.35, <=3.0.0-alpha.6) +134 more potentially affected by CVE-2026-53517 via better-auth (>=1.4.9, <=1.6.0-beta.0)

better-auth NPM version =1.4.9, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.0.7, =1.4.21, =1.7.0, =2026.512.0-canary.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-53517 Source advisory: OSV:GHSA-392P-2Q2V-4372...

@agentcorporation/server (>=0.3.3, <=0.3.13), @agentuity/auth (>=1.0.35, <=3.0.0-alpha.6) +134 more potentially affected by CVE-2026-53517 via better-auth (>=1.4.9, <=1.6.0-beta.0)

better-auth NPM version =1.4.9, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.0.7, =1.4.21, =1.7.0, =2026.512.0-canary.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-53517 Source advisory: GHSA-392P-2Q2V-4372...

@inkeep/agents-api (>=0.73.0, <=0.80.7), @inkeep/agents-cli (>=0.73.0, <=0.80.7) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.7 Source cves:...

GHSA-392P-2Q2V-4372 Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Am I affected? Users are affected if all of the following are true: - Their project depends on @better-auth/oauth-provider at a version = 1.6.0, = 1.4.8-beta.7, 1.6.0. - At least one OAuth client served by their application's authorization server requests the offlineaccess scope, so refresh token...

NPM: Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

NPM: Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by CVE-2026-67336 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-67336 Source advisory: OSV:GHSA-9H47-PQCX-HJR4...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889826...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: GHSA-9H47-PQCX-HJR4...

Insecure Default Initialization of Resource

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource in the oidcProvider. An attacker can gain unauthorized access or impersonate users by exploiting insecure...

GHSA-9H47-PQCX-HJR4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirecturi in oidc-provider and mcp vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.13...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +220 more potentially affected by CVE-2026-67333 via better-auth (>=1.0.0-canary.2, <=1.6.12)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-67333 Source advisory: OSV:GHSA-86J7-9J95-VPQJ...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +220 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.6.12)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-17889822...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +220 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.6.12)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: unknown CVE Source advisory: GHSA-86J7-9J95-VPQJ...

auth (>=1.7.0-beta.0, <=1.7.0-beta.3) potentially affected by CVE-2026-67333 via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.3)

better-auth NPM version =1.7.0-beta.0, =1.7.0-beta.0, =1.7.0-beta.3 Source cves: CVE-2026-67333 Source advisory: OSV:GHSA-86J7-9J95-VPQJ...