14840 matches found
Better Auth affected by external request basePath modification DoS
Summary Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users. This issue is only exploitable when baseURL is not explicitly...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.2) +64 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.4.2)
better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-14157194...
EUVD-2025-200097
Better Auth affected by external request basePath modification DoS...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.2-beta.5) +61 more potentially affected by CVE-2025-71401 via better-auth (>=1.0.0-canary.2, <=1.4.2-beta.5)
better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: CVE-2025-71401 Source advisory: OSV:GHSA-569Q-MPPH-WGWW...
MAL-2025-191565 Malicious code in auth-1s7epg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f86979a79a49db20dee0fecc4bf5e9a531adf3c2134b68b0828ed143f12514b2 The package auth-1s7epg was found to contain malicious code...
Malicious code in auth-1s7epg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f86979a79a49db20dee0fecc4bf5e9a531adf3c2134b68b0828ed143f12514b2 The package auth-1s7epg was found to contain malicious code...
Improper Authentication
python-social-auth is vulnerable to Improper Authentication. The vulnerability is due to automatic user association by email even when the associatebyemail pipeline is not enabled, where unvalidated or non-unique emails provided by third-party authentication services can be linked to existing...
PT-2025-48413
Name of the Vulnerable Software and Affected Versions orionsec orion-ops versions up to 5925824997a3109651bbde07460958a7be249ed1 Description A server-side request forgery condition exists in the SSH Connection Handler component of orionsec orion-ops. The issue is related to the manipulation of th...
PT-2025-62895
Name of the Vulnerable Software and Affected Versions better-auth npm versions prior to 1.4.2 Description An issue exists where an external request can configure the baseURL when it is not explicitly defined for example, when BETTER AUTH URL is unset. This occurs because the system implicitly...
Malicious Package
Overview auth-handler is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this package. Onc...
SUSE-SU-2025:21159-1 Security update for dovecot24
This update for dovecot24 fixes the following issues: - Update dovecot to 2.4.2: - CVE-2025-30189: Fixed users cached with same cache key when auth cache was enabled bsc1252839 - Changes - auth: Remove proxyalways field. - config: Change settings history parsing to use python3. - doveadm: Print...
EUVD-2025-199783
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces including the dashboard and Jobs API is disabled unless explicitly enabled by setting RAYAUTHMODE=token. In the default unauthenticated state, a remote attacker with...
PT-2025-51688
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the libceph component, specifically in the handle auth session key function. This issue could lead to potential out-of-bounds writes due to...
PT-2025-48291
Name of the Vulnerable Software and Affected Versions Astro versions 5.15.7 and below Description Astro, a web framework, is affected by a double URL encoding bypass. This allows unauthenticated attackers to bypass path-based authentication checks in Astro middleware, potentially granting...
Session Fixation
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Session Fixation via the constantTimeEqual function in the crypto/buffer.ts file. An attacker can cause arbitrary user sessions to be revoked by forging...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.3.34, <=1.4.0-beta.28) +7 more potentially affected by unknown CVE via better-auth (>=1.3.34, <=1.4.0-beta.28)
better-auth NPM version =1.3.34, =1.3.34, =1.0.8, =7.0.9-canary.2, =7.0.9-canary.2, =0.0.22, =0.8.2, =7.0.9-canary.2, =1.1.8-beta.3, =1.1.12 Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-14135654...
EUVD-2025-199765
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.3.34, <=1.4.0-beta.28) +7 more potentially affected by CVE-2025-71402 via better-auth (>=1.3.34, <=1.4.0-beta.28)
better-auth NPM version =1.3.34, =1.3.34, =1.0.8, =7.0.9-canary.2, =7.0.9-canary.2, =0.0.22, =0.8.2, =7.0.9-canary.2, =1.1.8-beta.3, =1.1.12 Source cves: CVE-2025-71402 Source advisory: OSV:GHSA-WMJR-V86C-M9JJ...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.3.34, <=1.4.0-beta.28) +7 more potentially affected by unknown CVE via better-auth (>=1.3.34, <=1.4.0-beta.28)
better-auth NPM version =1.3.34, =1.3.34, =1.0.8, =7.0.9-canary.2, =7.0.9-canary.2, =0.0.22, =0.8.2, =7.0.9-canary.2, =1.1.8-beta.3, =1.1.12 Source cves: unknown CVE Source advisory: GHSA-WMJR-V86C-M9JJ...