better-auth

Discord · Website · Issues Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a...

Authentication Bypass

Better Auth is vulnerable to authentication bypass. The vulnerability is due to overlapping stored identifiers under specific Magic Link and OAuth configuration settings, which allows an unauthenticated attacker to exploit the OAuth sign-in flow to obtain a valid session for an existing user or...

Better-auth: OAuth Proxy Lets An Attacker Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated "secret", or its "secret" equals...

Better-auth: Device Login Approval Does Not Show The Requesting Client Or Permissions

Am I affected? You may be affected if you use "better-auth" from "1.3.8-beta.3" up to, but not including, "1.7.0-rc.3", and you enable the "deviceAuthorization" plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device...

Better-auth: OAuth State Can Be Used As A Magic Link To Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from "1.4.0-beta.18" through versions before "1.7.7" with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default "storeToken: "plain"", or with...

@better-auth/drizzle-adapter: Concurrent Requests Can Exceed Rate Limits On PostgreSQL

Am I affected? You are affected if you use "@better-auth/drizzle-adapter" from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or "@better-auth/kysely-adapter" 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +340 more potentially affected by unknown CVE via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +336 more potentially affected by unknown CVE via better-auth (>=1.6.17, <=1.7.6)

better-auth NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves: unknown CVE...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +336 more potentially affected by CVE-2026-110861 via better-auth (>=1.6.17, <=1.7.6)

better-auth NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves: CVE-2026-110861...

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +176 more potentially affected by unknown CVE via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.6.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +176 more potentially affected by CVE-2026-110861 via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.6.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +340 more potentially affected by CVE-2026-110861 via @better-auth/drizzle-adapter (>=1.6.17, <=1.7.6)

@better-auth/drizzle-adapter NPM version =1.6.17, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.4.4, =1.4.7 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 and more Source cves...

GHSA-R4XP-PRCW-77QF better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +388 more potentially affected by unknown CVE via better-auth (>=1.5.0-beta.12, <=1.7.6)

better-auth NPM version =1.5.0-beta.12, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =0.0.2, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.6.0 and more Source cves: unknown CVE Source advisory:...

@abiyz/identity (>=0.2.0, <=0.2.6), @adaptcom/server (>=0.1.0-next-20260909201057, <=0.1.0-next-20260911225825) +388 more potentially affected by CVE-2026-110864 via better-auth (>=1.5.0-beta.12, <=1.7.6)

better-auth NPM version =1.5.0-beta.12, =0.2.0, =0.1.0-next-20260909201057, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =0.0.2, =0.1.10, =0.12.0, =0.28.0, =0.1.1, =1.0.0, =1.6.0 and more Source cves: CVE-2026-110864 Source advisory:...

npm: better-auth: OAuth Proxy lets an attacker sign in as another user

npm: better-auth: OAuth Proxy lets an attacker sign in as another user vulnerability discovered by ? in WordPress npm better-auth versions = 1.5.0-beta.12, 1.7.7...