13446 matches found
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...
CVE-2026-67331
CVE-2026-67331 affects better-auth SCIM, versions 1.5.0 up to but not including 1.7.0-beta.4. The vulnerability arises because non-organization SCIM providers are not bound to their creator by default, enabling an authenticated user to manage other users’ providers. Attackers can regenerate SCIM ...
CVE-2026-67335
Affected software: better-auth before 1.6.2. Vulnerability: OAuth state validation failure due to cookie-backed state storage without PKCE, allowing attackers to forge the state and supply an attacker-controlled authorization code. Impact: can create authenticated sessions bound to the attacker's...
@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +138 more potentially affected by CVE-2026-67335 via better-auth (>=0.4.9-beta.7, <=1.6.1)
better-auth NPM version =0.4.9-beta.7, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.0.7, =0.0.1, =1.2.5, =2026.512.0-canary.0, =2026.513.0 and more Source cves: CVE-2026-67335 Source advisory: MEND:CVE-2026-67335...
CVE-2025-71404
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...
CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...
CVE-2026-67335 better-auth before 1.6.2 OAuth State Validation Bypass
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...
@enbi/auth (>=0.1.0, <=0.11.0), @enbi/cli (>=0.1.0, <=0.11.0) +2 more potentially affected by CVE-2026-67327 via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.9)
better-auth NPM version =1.7.0-beta.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0-beta.0, =1.7.0-beta.9 Source cves: CVE-2026-67327 Source advisory: MEND:CVE-2026-67327...
CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
EUVD-2026-51841
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...
CVE-2025-71402
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...
CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields
axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...
CVE-2026-67314
axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...
CVE-2026-67330 better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...
CVE-2026-67314
axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...
CVE-2026-67314
CVE-2026-67314 affects axios versions >=1.15.2 and
CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...