better-auth vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-45337Highbetter-auth: Better Auth: Device authorization approve and deny accept any authenticated session while the user…CVE-2026-45364Highbetter-auth: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation GHSA-WXW3-Q3M9-C3JRMediumbetter-auth: Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used…GHSA-XG6X-H9C9-2M83Criticalbetter-auth: Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)GHSA-X732-6J76-QMHMHighbetter-auth: Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths…GHSA-569Q-MPPH-WGWWLowbetter-auth: Better Auth affected by external request basePath modification DoS GHSA-WMJR-V86C-M9JJLowbetter-auth: Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-61928Highbetter-auth: Better Auth: Unauthenticated API key creation through api-key plugin CVE-2025-53535Lowbetter-auth: Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes GHSA-VP58-J275-797XHighbetter-auth: Better Auth allows bypassing the trustedOrigins Protection which leads to ATO CVE-2025-27143Mediumbetter-auth: Beter Auth has an Open Redirect via Scheme-Less Callback Parameter GHSA-9X4V-XFQ5-M8X5Mediumbetter-auth: Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)CVE-2024-56734Highbetter-auth: Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo