@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Am I affected? Users are affected if all of the following are true: - Their application uses @better-auth/sso at a version = 0.1.0, 1.6.11 on the stable line, or any 1.7.0-beta.x on the pre-release line. - The sso plugin is added to their application's betterAuth plugins: ... array. - Any user wi...

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Am I affected? Users are affected if all of the following are true: - Their project depends on @better-auth/oauth-provider at a version = 1.6.0, = 1.4.8-beta.7, 1.6.0. - At least one OAuth client served by their application's authorization server requests the offlineaccess scope, so refresh token...

Insufficient Session Expiration

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Insufficient Session Expiration through the POST /oauth2/token endpoint during the refresh token granting. An attacker can gain unauthorized access by exploiting...

Insufficient Session Expiration

Overview @better-auth/memory-adapter is a Memory adapter for Better Auth Affected versions of this package are vulnerable to Insufficient Session Expiration through the POST /oauth2/token endpoint during the refresh token granting. An attacker can gain unauthorized access by exploiting a race...

GHSA-392P-2Q2V-4372 Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Am I affected? Users are affected if all of the following are true: - Their project depends on @better-auth/oauth-provider at a version = 1.6.0, = 1.4.8-beta.7, 1.6.0. - At least one OAuth client served by their application's authorization server requests the offlineaccess scope, so refresh token...

Insecure Default Initialization of Resource

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource in the oidcProvider. An attacker can gain unauthorized access or impersonate users by exploiting insecure...

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...

Missing Authorization

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Missing Authorization in the acceptInvitation function of the organization plugin when the system relies solely on an unverified email-string equality check ...

Incorrect Authorization

Overview @better-auth/oauth-provider is an An oauth provider plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization due to the OAuth token and refresh flows in packages/oauth-provider/src/token.ts, packages/oauth-provider/src/authorize.ts, and...

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

[SECURITY] [DSA 6382-1] postfix security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6382-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 07, 2026 https://www.debian.org/security/faq -...

Incorrect Authorization

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Incorrect Authorization in the refreshtoken grant process of the legacy oidcProvider and mcp plugins, where confidential clients are not required to...

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

GHSA-PW9M-5JXM-XR6H Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...

Improper Output Neutralization for Logs

Overview Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the readDomain parser in dns/dns.go. An attacker can write attacker-controlled domain labels into logs by supplying a DNS name containing disallowed characters, because the parser accepted eac...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the DNS request handling process. An attacker can bypass domain name filtering by crafting a DNS request containing multiple questions, where the first question appears legitimate but subsequent questions...

Server-side Request Forgery (SSRF)

Overview @aborruso/ckan-mcp-server is a MCP server for interacting with CKAN open data portals Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the validateServerUrl hostname check in src/utils/http.ts. An attacker can make the server send outbound...

Security Bulletin: IBM watsonx.data integration is vulnerable to authorization bypass due to the Moby package (CVE-2026-33997, CVE-2026-34040)

Summary Moby is used by IBM watsonx.data integration as part of container processing. Vulnerability Details CVEID:CVE-2026-33997 DESCRIPTION: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to...

Security Bulletin: IBM watsonx.data integration is vulnerable to payload verification errors due to the go-git package (CVE-2026-45022)

Summary go-git is used by IBM watsonx.data integration as part of repository handling. Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way...

Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in IBM watsonx.data integration. Vulnerability Details CVEID:CVE-2025-66506 DESCRIPTION: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.3,...