@better-auth/cli (>=1.0.0-canary.2, <=1.4.2-beta.5), @effectify/node-better-auth (0.4.0) +6 more potentially affected by CVE-2025-71401 via better-auth (>=1.0.0-canary.2, <=1.4.2-beta.5)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.0.0, =1.1.368, =6.8.0, =6.20.0 Source cves: CVE-2025-71401 Source advisory: GHSA-569Q-MPPH-WGWW...

@better-auth/cli (>=1.0.0-canary.2, <=1.4.2-beta.5), @effectify/node-better-auth (0.4.0) +6 more potentially affected by CVE-2025-71401 via better-auth (>=1.0.0-canary.2, <=1.4.2-beta.5)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.0.0, =1.1.368, =6.8.0, =6.20.0 Source cves: CVE-2025-71401 Source advisory: OSV:GHSA-569Q-MPPH-WGWW...

External Control of File Name or Path

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to External Control of File Name or Path via the getBaseURL function. An attacker can cause all routes to return 404 errors for all users by sending a crafted...

EUVD-2025-200097

Better Auth affected by external request basePath modification DoS...

@better-auth/cli (>=1.0.0-canary.2, <=1.4.2), @effectify/node-better-auth (0.4.0) +9 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.4.2)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.0.0, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.4, =1.1.368, =6.8.0, =6.20.0 Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-14157194...

PT-2025-62895

Name of the Vulnerable Software and Affected Versions better-auth npm versions prior to 1.4.2 Description An issue exists where an external request can configure the baseURL when it is not explicitly defined for example, when BETTER AUTH URL is unset. This occurs because the system implicitly...

Session Fixation

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Session Fixation via the constantTimeEqual function in the crypto/buffer.ts file. An attacker can cause arbitrary user sessions to be revoked by forging...

EUVD-2025-199765

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions...

PT-2025-62896

Name of the Vulnerable Software and Affected Versions better-auth versions 1.3.35 through 1.3.99 Description The multi-session plugin contains a flaw in the /sign-out endpoint after-hook. The system trusts raw multi-session cookies and forwards extracted values to the deleteSessions function with...

PT-2025-49391

Summary A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts raw multi-session cookies and forwards the extracted values directly to internalAdapter.deleteSessions without verifying the cookie signature. Because cook...

EUVD-2025-199652

Better Auth Passkey Plugin allows passkey deletion through IDOR...

Authorization Bypass Through User-Controlled Key

Overview @better-auth/passkey is a Passkey plugin for Better Auth Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a POST /passkey/delete-passkey request. An attacker can delete arbitrary passkeys belonging to other users by providing their...

EUVD-2025-199293

Malicious code in @silgi/better-auth npm...

Malicious code in @silgi/better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 528101596869077cdc065844f592e42299e9806c92d2b4f6f145ccd18194fdd5 The package @silgi/better-auth was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191311 Malicious code in @silgi/better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 528101596869077cdc065844f592e42299e9806c92d2b4f6f145ccd18194fdd5 The package @silgi/better-auth was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199169

Malicious code in better-auth-nuxt npm...

Malicious code in better-auth-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63a2c1f5ccee32dc0e1c83e0664d434add6b894caa54c57f137fe0367cba558f The package better-auth-nuxt was found to contain malicious code. Source: ghsa-malware 14fe0837bf9131779e90c6a1e8530acbe2d811b2df09dfa25d2d86c5a151c0...

MAL-2025-191073 Malicious code in better-auth-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63a2c1f5ccee32dc0e1c83e0664d434add6b894caa54c57f137fe0367cba558f The package better-auth-nuxt was found to contain malicious code. Source: ghsa-malware 14fe0837bf9131779e90c6a1e8530acbe2d811b2df09dfa25d2d86c5a151c0...

CVE-2025-61928

CVE-2025-61928 affects Better Auth (TypeScript) prior to version 1.3.26. The vulnerability allows unauthenticated attackers to create or modify API keys for any user by supplying the target user’s id in the request body to api/auth/api-key/create (and similarly in the update endpoint). The issue ...

CVE-2025-61928 Better Auth: Unauthenticated API key creation through api-key plugin

Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the api/auth/api-key/create route. session?.user ?? authRequired ? null : i...