ROOT-APP-NPM-CVE-2026-114607 CVE-2026-114607 in better-auth - Patched by Root

Root has patched CVE-2026-114607 in the better-auth package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-136329 AIKIDO-2026-136329 in better-auth - Patched by Root

Root has patched AIKIDO-2026-136329 in the better-auth package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-R4XP-PRCW-77QF GHSA-r4xp-prcw-77qf in better-auth - Patched by Root

Root has patched GHSA-r4xp-prcw-77qf in the better-auth package for Root:npm. Multiple fixed versions available...

better-auth

Discord · Website · Issues Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a...

CVE-2026-110863

A flaw was found in @better-auth/sso. An authenticated attacker can exploit this vulnerability to bypass authentication and gain unauthorized access to other user accounts by registering a custom Single Sign-On SSO provider. Because the application ignores the provider identifier during account...

Better Auth (Expo plugin): Auth Bypass

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

CVE-2026-121802

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

Origin Validation Error

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Origin Validation Error via the expo plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the expo plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret without verifying that the server had previously issued that value. Because the sam...

CVE-2026-121802

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

CVE-2026-121802

The @better-auth/expo package (versions before 1.7.16 ) is vulnerable to account-takeover due to an Origin Validation Error (CWE-346). The flaw exists because the software signs a caller-supplied state value without verifying if that value was originally issued by the server. This can lead to una...

CVE-2026-121802

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

PT-2026-136822

Name of the Vulnerable Software and Affected Versions @better-auth/expo versions prior to 1.7.16 Description An issue in the Expo plugin allows a remote, unauthenticated attacker to perform account takeovers, such as changing the email address of any account. This occurs because the system signs ...

Authentication Bypass

Better Auth is vulnerable to authentication bypass. The vulnerability is due to overlapping stored identifiers under specific Magic Link and OAuth configuration settings, which allows an unauthenticated attacker to exploit the OAuth sign-in flow to obtain a valid session for an existing user or...

Better-auth: OAuth Proxy Lets An Attacker Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated "secret", or its "secret" equals...

Better-auth: Device Login Approval Does Not Show The Requesting Client Or Permissions

Am I affected? You may be affected if you use "better-auth" from "1.3.8-beta.3" up to, but not including, "1.7.0-rc.3", and you enable the "deviceAuthorization" plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device...

Better-auth: OAuth State Can Be Used As A Magic Link To Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from "1.4.0-beta.18" through versions before "1.7.7" with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default "storeToken: "plain"", or with...

@better-auth/drizzle-adapter: Concurrent Requests Can Exceed Rate Limits On PostgreSQL

Am I affected? You are affected if you use "@better-auth/drizzle-adapter" from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or "@better-auth/kysely-adapter" 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these...

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...