better-auth (npm)
Advisories
30
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.7.7 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install better-auth@1.7.7yarn
yarn add better-auth@1.7.7pnpm
pnpm add better-auth@1.7.7Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user |
Critical EPSS 0.29% |
>= 1.5.0-beta.12, < 1.7.7 | 1.7.7 |
| GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user |
Critical EPSS 0.42% |
>= 1.4.0-beta.18, < 1.7.7 | 1.7.7 |
| GHSA-44jh-23m7-hpcf @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL |
Medium EPSS 0.22% |
>= 1.6.17, < 1.7.7 | 1.7.7 |
| GHSA-q84f-53jg-9ppm better-auth: Device login approval does not show the requesting client or permissions |
High EPSS 0.28% |
>= 1.3.8-beta.3, < 1.7.0-rc.3 | 1.7.0-rc.3 |
| GHSA-3q45-2fh7-66cj Duplicate Advisory: better-auth has an external request basePath modification DoS Withdrawn |
Medium | < 1.4.2 | 1.4.2 |
| GHSA-qq9h-g4jm-xgf3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in |
High EPSS 0.43% |
>= 1.1.3, < 1.6.22 | 1.6.22 |
| GHSA-qq9h-g4jm-xgf3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in |
High EPSS 0.43% |
>= 1.7.0-beta.0, < 1.7.0-beta.10 | 1.7.0-beta.10 |
| GHSA-2vg6-77g8-24mp Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows |
Medium EPSS 0.32% |
>= 0.3.4, < 1.6.11 | 1.6.11 |
| GHSA-7w99-5wm4-3g79 @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive |
High EPSS 0.41% |
< 1.6.11 | 1.6.11 |
| GHSA-392p-2q2v-4372 Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption |
High EPSS 0.42% |
>= 1.4.8-beta.7, < 1.6.0 | 1.6.0 |
| GHSA-9h47-pqcx-hjr4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default |
Critical EPSS 0.24% |
< 1.6.11 | 1.6.11 |
| GHSA-86j7-9j95-vpqj Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp |
Medium EPSS 0.26% |
< 1.6.13 | 1.6.13 |
| GHSA-86j7-9j95-vpqj Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp |
Medium EPSS 0.26% |
>= 1.7.0-beta.0, < 1.7.0-beta.4 | 1.7.0-beta.4 |
| GHSA-g38m-r43w-p2q7 Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email |
High EPSS 0.29% |
< 1.6.11 | 1.6.11 |
| GHSA-fmh4-wcc4-5jm3 Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin |
High EPSS 0.20% |
< 1.6.11 | 1.6.11 |
| GHSA-pw9m-5jxm-xr6h Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins |
Critical EPSS 0.27% |
< 1.6.11 | 1.6.11 |
| GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending |
High EPSS 0.21% |
>= 1.6.0, < 1.6.11 | 1.6.11 |
| GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation |
High EPSS 0.29% |
< 1.4.17 | 1.4.17 |
| GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation |
High EPSS 0.29% |
>= 1.5.0-beta.1, < 1.5.0-beta.9 | 1.5.0-beta.9 |
| GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE |
Medium EPSS 0.28% |
< 1.6.2 | 1.6.2 |
| GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) |
Medium EPSS 0.46% |
< 1.4.9 | 1.4.9 |
| GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits |
High EPSS 0.52% |
< 1.4.5 | 1.4.5 |
| GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS |
Medium EPSS 0.46% |
< 1.4.2 | 1.4.2 |
| GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions |
Low EPSS 0.27% |
>= 1.3.34, < 1.4.0 | 1.4.0 |
| GHSA-99h5-pjcv-gr6v Better Auth: Unauthenticated API key creation through api-key plugin |
Critical EPSS 19.72% |
< 1.3.26 | 1.3.26 |
| GHSA-36rg-gfq2-3h56 Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes |
Low EPSS 0.38% |
< 1.2.10 | 1.2.10 |
| GHSA-vp58-j275-797x Better Auth allows bypassing the trustedOrigins Protection which leads to ATO |
High EPSS 0.34% |
< 1.1.21 | 1.1.21 |
| GHSA-hjpm-7mrm-26w8 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter |
Medium EPSS 0.35% |
< 1.1.20 | 1.1.20 |
| GHSA-9x4v-xfq5-m8x5 Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) |
Medium EPSS 0.72% |
>= 0.0.2, < 1.1.16 | 1.1.16 |
| GHSA-8jhw-6pjj-8723 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint |
Medium EPSS 0.39% |
< 1.1.6 | 1.1.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor