@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53514 Source advisory: GHSA-FMH4-WCC4-5JM3...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53514 Source advisory: SNYK:JS-BETTERAUTH-17889813...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53514 Source advisory: OSV:GHSA-FMH4-WCC4-5JM3...

Missing Authorization

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Missing Authorization in the acceptInvitation function of the organization plugin when the system relies solely on an unverified email-string equality check ...

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth with the organization plugin import organization from "better-auth/plugins/organization". - Their application enables a sign-up surface that allows arbitrary unverified email registration. Mos...

Incorrect Authorization

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization due to the OAuth token and refresh flows in packages/oauth-provider/src/token.ts, packages/oauth-provider/src/authorize.ts, and...

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53512 Source advisory: SNYK:JS-BETTERAUTH-17889816...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53512 Source advisory: OSV:GHSA-PW9M-5JXM-XR6H...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +146 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0-canary.2, <=1.6.10)

better-auth NPM version =1.0.0-canary.2, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.2.5, =1.9.7 and more Source cves: CVE-2026-53512 Source advisory: GHSA-PW9M-5JXM-XR6H...

GHSA-PW9M-5JXM-XR6H Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

hass-auth-synology (>=0.4.13, <=0.4.28), homeassistant-stubs (2022.12.9) potentially affected by CVE-2025-65713 via homeassistant (2022.12.9)

homeassistant PYPI version 2022.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - hass-auth-synology =0.4.13, =0.4.28 - homeassistant-stubs 2022.12.9 Source cves: CVE-2025-65713 Source advisory: OSV:PYSEC-2026-14...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +1599 more potentially affected by CVE-2025-62727 via starlette (>=0.39.2, <=0.48.0)

starlette PYPI version =0.39.2, =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: CVE-2025-62727 Source advisory: OSV:PYSEC-2026-1942...

django-auth0-user (>=0.15.0, <=0.16.5), edx-auth-backends (>=3.0.0, <=3.0.2) +4 more potentially affected by CVE-2025-61783 via social-auth-app-django (3.4.0)

social-auth-app-django PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =0.1.0, =4.4.0a1, =0.2.0, =2.0.0, =5.0.1 Source cves: CVE-2025-61783 Source...

edx-auth-backends (>=1.0.1, <=2.0.2), rest-social-auth (1.2.0) potentially affected by CVE-2025-61783 via social-auth-app-django (1.2.0)

social-auth-app-django PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - edx-auth-backends =1.0.1, =2.0.2 - rest-social-auth 1.2.0 Source cves: CVE-2025-61783 Source advisory:...

django-globus-portal-framework (>=0.3.23, <=0.4.2), django-user-app (0.0.6) +14 more potentially affected by CVE-2025-61783 via social-auth-app-django (4.0.0)

social-auth-app-django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-globus-portal-framework =0.3.23, =2.28.1, =1.3.0, =1.0.0b3, =1.6.0, =0.9.2.dev0, =0.9.0, =0.1.0, =6.0.0,...