@anchrd/gate (>=0.28.0, <=0.40.0), @anchrd/gate-api (>=0.1.1, <=0.26.0) +29 more potentially affected by unknown CVE via @better-auth/oauth-provider (>=1.5.5, <=1.6.28)

@better-auth/oauth-provider NPM version =1.5.5, =0.28.0, =0.1.1, =1.0.0, =2.0.0, =2.0.0, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712,...

Incorrect Authorization

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization due to the OAuth token and refresh flows in packages/oauth-provider/src/token.ts, packages/oauth-provider/src/authorize.ts, and...

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

GHSA-PW9M-5JXM-XR6H Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: OSV:GHSA-PW9M-5JXM-XR6H...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: SNYK:JS-BETTERAUTH-17889816...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +203 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: GHSA-PW9M-5JXM-XR6H...

hass-auth-synology (>=0.4.13, <=0.4.28), homeassistant-stubs (2022.12.9) potentially affected by CVE-2025-65713 via homeassistant (2022.12.9)

homeassistant PYPI version 2022.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - hass-auth-synology =0.4.13, =0.4.28 - homeassistant-stubs 2022.12.9 Source cves: CVE-2025-65713 Source advisory: OSV:PYSEC-2026-14...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.5.1 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +1607 more potentially affected by CVE-2025-62727 via starlette (>=0.39.2, <=0.48.0)

starlette PYPI version =0.39.2, =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: CVE-2025-62727 Source advisory: OSV:PYSEC-2026-1942...

django-cyverse-auth (1.0.0), django-iplant-auth (>=0.0.2, <=0.1.21) potentially affected by CVE-2025-61911 via python-ldap (2.4.19)

python-ldap PYPI version 2.4.19 is affected by a known vulnerability. The following packages have a transitive dependency on python-ldap and may be impacted: - django-cyverse-auth 1.0.0 - django-iplant-auth =0.0.2, =0.1.21 Source cves: CVE-2025-61911 Source advisory: OSV:PYSEC-2026-1847...

django-cyverse-auth (1.0.0), django-iplant-auth (>=0.0.2, <=0.1.21) potentially affected by CVE-2025-61912 via python-ldap (2.4.19)

python-ldap PYPI version 2.4.19 is affected by a known vulnerability. The following packages have a transitive dependency on python-ldap and may be impacted: - django-cyverse-auth 1.0.0 - django-iplant-auth =0.0.2, =0.1.21 Source cves: CVE-2025-61912 Source advisory: OSV:PYSEC-2026-1846...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2025-62706 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

pixelcms-server (>=0.4.1, <=0.4.2), rest-social-auth (>=1.0.0, <=1.1.0) potentially affected by CVE-2025-61783 via social-auth-app-django (0.1.0)

social-auth-app-django PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - pixelcms-server =0.4.1, =1.0.0, =1.1.0 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2025-61783 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

umap-project (0.8.3) potentially affected by CVE-2025-61783 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2025-61783 Source advisory: OSV:PYSEC-2026-1932...

edx-auth-backends (>=1.0.1, <=2.0.2), rest-social-auth (1.2.0) potentially affected by CVE-2025-61783 via social-auth-app-django (1.2.0)

social-auth-app-django PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - edx-auth-backends =1.0.1, =2.0.2 - rest-social-auth 1.2.0 Source cves: CVE-2025-61783 Source advisory:...