@anchrd/gate (>=0.28.0, <=0.32.0), @anchrd/gate-api (>=0.1.1, <=0.26.0) +21 more potentially affected by unknown CVE via @better-auth/oauth-provider (>=1.5.5, <=1.6.25)

@better-auth/oauth-provider NPM version =1.5.5, =0.28.0, =0.1.1, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712...

@anchrd/gate (>=0.28.0, <=0.32.0), @anchrd/gate-api (>=0.1.1, <=0.26.0) +21 more potentially affected by CVE-2026-67332 via @better-auth/oauth-provider (>=1.5.5, <=1.6.25)

@better-auth/oauth-provider NPM version =1.5.5, =0.28.0, =0.1.1, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: SNYK:JS-BETTERAUTH-17889816...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: OSV:GHSA-PW9M-5JXM-XR6H...

GHSA-PW9M-5JXM-XR6H Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

PT-2026-67313

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.13 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.3 Description The deprecated oidc-provider plugin and the mcp plugin fail to validate the scheme of redirect uris during OAuth client registration. An...

PT-2026-56297

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The legacy oidcProvider and mcp plugins expose an OAuth 2.0 token endpoint that fails to authenticate confidential clients during the refresh token grant. The system authenticates requests based...

PT-2026-56298

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 0.1.0 through 1.6.10 @better-auth/sso versions 1.7.0-beta.x Description An SSRF flaw exists in the provider registration flow where OpenID Connect OIDC endpoint URLs are accepted without proper validation. When...

PT-2026-56299

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Better Auth versions 1.6.14 and later Description An issue exists in the organization plugin where the acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations endpoints do not sufficientl...

PT-2026-56300

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Description An issue exists in the OAuth callback auto-link gate within the handleOAuthUserInfo function. The system allows implicit account linking when an OAuth provider asserts email verified: true witho...

PT-2026-67316

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The oidcProvider and mcp plugins contain insecure cryptographic defaults. The discovery document advertises the none algorithm in id token signing alg values supported and resource signing alg...

PT-2026-67314

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 @better-auth/scim versions prior to 1.6.11 Description When secondaryStorage is configured and storeSessionInDatabase is set to false, certain user-deletion processes fail to remove cached sessions. This...

Malicious code in @mastra/auth-better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f3ba577912ece34e70e0f5d94ee38bf681dc3f0d2a2125d0bbe95c98dbbe3a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-45364

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for or the configured IP-bearing header. IPv6 clients controlling a typical /6...

Improper Authorization

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authorization in the deviceAuthorization plugin. An attacker can gain unauthorized access to a device or deny legitimate user sign-in by submitting ...

@agent-native/core (>=0.26.5, <=0.47.1), @automate.ax/components-core (>=0.1.3, <=0.3.1) +32 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0, <=1.6.10)

better-auth NPM version =1.6.0, =0.26.5, =0.1.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.11.3, =0.73.0, =0.73.0, =0.73.1, =0.80.6 and more Source cves: CVE-2026-45337 Source advisory: OSV:GHSA-CQ3F-VC6P-68FH...

@agent-native/core (>=0.26.5, <=0.47.1), @automate.ax/components-core (>=0.1.3, <=0.3.1) +32 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0, <=1.6.10)

better-auth NPM version =1.6.0, =0.26.5, =0.1.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.11.3, =0.73.0, =0.73.0, =0.73.1, =0.80.6 and more Source cves: CVE-2026-45337 Source advisory: SNYK:JS-BETTERAUTH-17173857...

PT-2026-46307

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.6.0 through 1.6.10 Description The deviceAuthorization plugin incorrectly treats any authenticated session as the owner of any pending device code. This occurs because the GET /device endpoint does not claim the row, and...

CVE-2026-45364

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in x-forwarded-for or the configured IP-bearing header. IPv6 clients controlling a typical /6...