229 matches found
@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.73.0), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.72.2) +8 more potentially affected by CVE-2026-41427 via @better-auth/oauth-provider (1.5.5)
@better-auth/oauth-provider NPM version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321...
@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.73.0), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.72.2) +8 more potentially affected by CVE-2026-41427 via @better-auth/oauth-provider (1.5.5)
@better-auth/oauth-provider NPM version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260410224321...
Authentication Bypass Using an Alternate Path or Channel
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the session.cookieCache component. An attacker can gain unauthorized access to protected...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +73 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.4.8-beta.4)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-15876756...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.6-beta.2) +73 more potentially affected by CVE-2026-67337 via better-auth (>=1.0.0, <=1.4.8-beta.4)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =2.0.3 and more Source cves: CVE-2026-67337 Source advisory: OSV:GHSA-XG6X-H9C9-2M83...
better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2025-6087 +1 more via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)
@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2025-6087, CVE-2026-3125 Source...
better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2026-3125 via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)
@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2026-3125 Source advisory:...
EUVD-2025-203845
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits...
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
Summary An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs e.g., by collapsing multiple slashes, this can allow bypasses of disabledPaths and path-based rate limits. Details Better Auth...
GHSA-X732-6J76-QMHM Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
Summary An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs e.g., by collapsing multiple slashes, this can allow bypasses of disabledPaths and path-based rate limits. Details Better Auth...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.4) +67 more potentially affected by CVE-2025-71399 via better-auth (>=1.0.0, <=1.4.4-beta.3)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: CVE-2025-71399 Source advisory: OSV:GHSA-X732-6J76-QMHM...
Authentication Bypass
better-auth is vulnerable to an Authentication Bypass. The vulnerability is due to improper handling of the userId field when no session exists, allowing attackers to supply a victim’s ID and have the server treat them as that user, enabling unauthenticated creation or modification of API keys an...
External Control of File Name or Path
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to External Control of File Name or Path via the getBaseURL function. An attacker can cause all routes to return 404 errors for all users by sending a crafted...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.1) +63 more potentially affected by CVE-2025-71401 via better-auth (>=1.0.0, <=1.4.1-beta.1)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: CVE-2025-71401 Source advisory: OSV:GHSA-569Q-MPPH-WGWW...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.2) +66 more potentially affected by unknown CVE via better-auth (>=1.0.0, <=1.4.2-beta.5)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-BETTERAUTH-14157194...
Better Auth affected by external request basePath modification DoS
Summary Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users. This issue is only exploitable when baseURL is not explicitly...
EUVD-2025-200097
Better Auth affected by external request basePath modification DoS...
Session Fixation
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Session Fixation via the constantTimeEqual function in the crypto/buffer.ts file. An attacker can cause arbitrary user sessions to be revoked by forging...
@alstar/studio (0.0.0-beta.20), @better-auth/cli (1.3.34) +7 more potentially affected by unknown CVE via better-auth (1.3.34)
better-auth NPM version 1.3.34 is affected by a known vulnerability. The following packages have a transitive dependency on better-auth and may be impacted: - @alstar/studio 0.0.0-beta.20 - @better-auth/cli 1.3.34 - @bgord/bun =1.0.8, =7.0.9-canary.2, =7.0.9-canary.2, =0.0.22, =0.8.2,...