better-auth vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-2VG6-77G8-24MPLowbetter-auth: Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows CVE-2026-53518High@better-auth/oauth-provider: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete…CVE-2026-53517High@better-auth/oauth-provider: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption GHSA-9H47-PQCX-HJR4Highbetter-auth: Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default GHSA-86J7-9J95-VPQJHighbetter-auth: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp CVE-2026-53516Highbetter-auth: Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email CVE-2026-53514Highbetter-auth: Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin CVE-2026-53512Criticalbetter-auth: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CVE-2026-45337Highbetter-auth: Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending CVE-2026-45364Highbetter-auth: Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation GHSA-WXW3-Q3M9-C3JRMediumbetter-auth: Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE GHSA-XG6X-H9C9-2M83Criticalbetter-auth: Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)GHSA-X732-6J76-QMHMHighbetter-auth: Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits GHSA-569Q-MPPH-WGWWLowbetter-auth: Better Auth affected by external request basePath modification DoS GHSA-WMJR-V86C-M9JJLowbetter-auth: Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-61928Highbetter-auth: Better Auth: Unauthenticated API key creation through api-key plugin CVE-2025-53535Lowbetter-auth: Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes GHSA-VP58-J275-797XHighbetter-auth: Better Auth allows bypassing the trustedOrigins Protection which leads to ATO CVE-2025-27143Mediumbetter-auth: Beter Auth has an Open Redirect via Scheme-Less Callback Parameter GHSA-9X4V-XFQ5-M8X5Mediumbetter-auth: Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)CVE-2024-56734Highbetter-auth: Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo