@better-auth/sso

@better-auth/sso

Bug Fixes

• Fixed OIDC SSO sign-in to reject ID tokens missing exp or iat and providers with an empty client ID, matching social sign-in

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed repeated PostgreSQL migration diffs for int8 columns.

• Fixed database-backed rate limiting returning an excessively large X-Retry-After value.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed plugin init returns with options: undefined failing type checks under exactOptionalPropertyTypes.

• Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at <issuer>/.well-known/jwks.json.

• Reduced installation size while preserving OpenTelemetry instrumentation attributes.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed OpenAPI schemas for /oauth2/consent and /oauth2/continue to match their redirect responses.

• Fixed CIMD metadata refreshes overwriting concurrent administrator changes to discovered clients.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed Expo social account linking with ID tokens when a session cookie is present.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed Captcha and OpenAPI plugin subpath imports and type resolution for better-auth/plugins/multi-session and better-auth/test.

• Fixed Google One Tap sign-ins not recording google as the last login method.

• Fixed imports from better-auth/plugins/one-tap failing with a not-exported error.

• Fixed Google One Tap ignoring plugin-level autoSelect and cancelOnTapOutside settings.

• Fixed Google One Tap sign-ins ignoring configured Google profile mapping and user info updates.

• Fixed Google One Tap calling a prompt method unsupported by FedCM and retrying skipped prompts.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional self-service signing key rotation for private_key_jwt clients.

Bug Fixes

• Fixed valid DPoP proofs being rejected for parameterized routes and URLs with trailing slashes.

• Fixed native clients with HTTP loopback callbacks being rejected when application type inference is enabled.

• Fixed device-code clients being unable to refresh access for approved resources omitted from a token poll.

• Fixed OAuth consent without a reference overwriting or reusing consent for a different reference.

• Fixed dynamic client registration rejecting requests that include both supported and unsupported grants.

• Fixed attempts to change cached trusted clients returning HTTP 500 instead of HTTP 400.

• Improved errors for unknown OAuth client_id values to say client not found.

• Fixed PKCE verifier errors to return the specified HTTP 400 response and error code.

• Fixed unknown OAuth clients receiving invalid_grant instead of invalid_client at the token endpoint.

• Fixed unverifiable JWT access tokens causing server errors at /oauth2/userinfo, /oauth2/introspect, and /oauth2/revoke.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Limited JWKS refetches for unknown key IDs to protect servers from repeated requests.

• Fixed unreachable JWKS endpoints being reported as invalid tokens instead of server errors.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed MongoDB findMany ignoring ID sorting and potentially repeating or skipping paginated results.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed onAPIError.onError handlers to finish before responses are sent and log failures without interrupting requests

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Added isContinuation to postLogin.shouldRedirect so users can complete authorization after selecting an organization

• Fixed DPoP validation for token and UserInfo requests behind proxies that rewrite request URLs

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Aligned @better-auth/utils and better-call dependency versions across official packages

• Fixed SSO provider registration and updates rejecting partial mapping values that omit defaulted fields

• Fixed SAML providers with linked accounts rejecting IdP signing certificate rotation

• Rejected OIDC SSO providers whose configured issuer does not match discovery, preventing later sign-in failures

• Fixed SAML providers with linked accounts rejecting changes to their post-login callbackUrl

• Fixed OIDC sign-in when the mapped email claim contains a list of addresses

For detailed changes, see CHANGELOG

better-auth

Magic Link upgrade: Upgrade servers sharing verification storage together, request new Magic Links, and restart pending OAuth/SAML sign-ins. No database migration is required. See the critical advisory for affected configurations and custom storage changes.

Bug Fixes

• security

  Fixed a critical Magic Link account-takeover vulnerability.

• Fixed ID-token sign-in ignoring the social provider’s disableSignUp setting.

• Fixed OAuth Proxy accepting sign-in state as a provider profile.
  Upgrade all OAuth Proxy participants together; see the OAuth Proxy upgrade guidance.

• Fixed CAPTCHA errors missing the JSON Content-Type header.

• Fixed the active organization failing to refresh after sign-in when a session hook selects the initial organization.

• Fixed rate-limit errors missing the JSON Content-Type header.

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Features

• Added optional validateRedirectUri validation for trusted deployments with dynamic OAuth redirect URIs.

• Added verifyOAuthQueryParams to verify signed authorization queries before rendering a custom consent page.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed concurrent PostgreSQL requests exceeding database-backed rate limits.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed consumeOne deleting a record after a concurrent write invalidates its original condition.

For detailed changes, see CHANGELOG

better-auth

Features

• Added support for a bannedUserMessage function that receives the banned user, allowing sign-in errors to include details such as the ban reason.

• Added Vercel BotID as a captcha provider for protected authentication routes.

Bug Fixes

• Passwords over maxPasswordLength are now rejected with PASSWORD_TOO_LONG before hashing or verification.

• Fixed React hydration mismatches when session or plugin auth queries resolve before streamed components hydrate.

• Prevented older auth-query responses from overwriting newer results when requests overlap.

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

• Fixed social account linking through the OAuth Proxy plugin.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for SQLite-generated primary keys, including INTEGER PRIMARY KEY columns without AUTOINCREMENT.

• Fixed schema validation for Cloudflare D1 when the Kysely dialect cannot introspect the database.

For detailed changes, see CHANGELOG

@better-auth/prisma-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

• Fixed schema validation for capitalized custom Prisma model names.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/memory-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/mongo-adapter

Bug Fixes

• Fixed model identity when a custom model name matches another schema key.

For detailed changes, see CHANGELOG

@better-auth/stripe

Bug Fixes

• Fixed automatic seat updates after an organization resubscribes, even when canceled subscriptions remain in its history.

For detailed changes, see CHANGELOG

auth

Features

• Added read-only check and check schema commands to validate your configured adapter schema on demand.

For detailed changes, see CHANGELOG

better-auth

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Improved server-side logging for Cloudflare Turnstile verification failures.

• Fixed PostgreSQL migrations incorrectly identifying tables and views across schemas.

• Fixed MySQL index validation for existing string columns.

• Removed the unused optional better-sqlite3 peer dependency to prevent installation conflicts.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added database.schemaName support for direct PostgreSQL connections.

Bug Fixes

• Fixed database option type inference outside Cloudflare Workers.

For detailed changes, see CHANGELOG

@better-auth/cimd

Bug Fixes

• Fixed unnecessary pacing of consecutive CIMD OAuth requests when metadata cannot be cached.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed lazy database initialization when using Drizzle relations.

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

Features

• Added database.schemaName support for direct PostgreSQL connections.

For detailed changes, see CHANGELOG

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

• Added support for additional session fields in testUtils auth helpers.

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance.

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed.

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore.

• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates.

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter.

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Restored compatibility with 1.6 account schemas by identifying accounts with (providerId, accountId) instead of issuer.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Improved validation of relative callback and redirect URLs with paths, queries, and fragments.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed SSO provider registration to allow reusing a SCIM connection ID, as SCIM connections no longer participate in the authentication provider namespace.

• Fixed SAML assertion signature verification to validate signatures on the raw assertion instead of trusting an already-parsed response, and enforced signing policy and size limits on SP metadata. wantAssertionsSigned now correctly controls whether the SP requires signed assertions, matching real-world IdP signing behavior.

For detailed changes, see CHANGELOG

@better-auth/sso

Breaking Changes

• breaking

  Scoped account identity by trusted issuer, keying accounts on (issuer, accountId)

  Migration: Accounts now require Account.issuer. SSO subjects are protocol-defined (sub for OIDC, signed NameID for SAML) and mapping.id is removed; a manual SAML config without metadata XML must set idpMetadata.entityID. Apply the account-identity backfill in the 1.7 upgrade guide before deploying.

• breaking

  Added rolling SAML certificate rotation by accepting an array of IdP signing certificates

  Migration: getSSOProvider, listSSOProviders, and updateSSOProvider now always return samlConfig.certificate as an array, so drop any Array.isArray branching. Registration rejects SAML configs with no signing-cert source with CERT_SOURCE_MISSING.

• breaking

  Hardened the validateUserInfo source contract so it cannot be bypassed or spoofed

  Migration: createUser now fails closed when validateUserInfo is configured but no endpoint context or provisioning source is available. Read SSO metadata from source.sso instead of source.oauth, and handle the source.method values sso-oidc and sso-saml.

• breaking

  Hardened SAML response validation for InResponseTo, audience restriction, and SessionIndex

  Migration: allowIdpInitiated now defaults to false. Set saml.allowIdpInitiated: true to keep accepting unsolicited SAML responses.

• breaking

  Consolidated the SAML ACS endpoint, made spMetadata optional, and fixed Single Logout

  Migration: Point your IdP's ACS URL at /sso/saml2/sp/acs/:providerId; /sso/saml2/callback/:providerId is removed. callbackUrl is now the post-auth redirect only, and the unused decryptionPvk, additionalParams, idpMetadata.entityURL, and idpMetadata.redirectURL fields are gone.

Features

• Added a user.validateUserInfo gate for rejecting an identity before a user is created or linked

• Added allowIdpInitiated support for IdP-initiated flows through a secure server-side bounce

• Added private_key_jwt client authentication for token endpoint requests (RFC 7523)

• Added per-request additionalParams and loginHint across signIn.social, linkSocial, and signIn.sso

• Added a server-trusted OAuth state channel, fixing anonymous account linking in in-app browsers

• Added transactional OIDC user resolution for SSO sign-ins

• Extended resolveUser to SAML sign-ins and hardened the provider lifecycle

• Added additionalFields support on ssoProvider

Bug Fixes

• Allowed an SSO provider registration to reuse a SCIM connection ID, since SCIM connections no longer share the authentication provider namespace.

• Rejected redirecting OIDC discovery, token, userinfo, and JWKS endpoints so SSO works on Cloudflare Workers

• Updated samlify to 2.13.1 for a signed-assertion XML injection fix

• Upgraded samlify to 2.12.0 with XPath injection and XXE fixes

• Single-sourced HTTP Basic credential encoding and decoding for OAuth client authentication

• Verified SAML assertion signatures directly instead of trusting an already-parsed response, and applied the same signing policy and size limit to SP metadata as to IdP metadata. wantAssertionsSigned now controls whether signed assertions are required rather than signed response messages, matching how IdPs sign SAML responses in practice.

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed database option type inference for projects that do not use Cloudflare Workers.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Improved diagnostics for Cloudflare Turnstile verification failures

For detailed changes, see CHANGELOG

better-auth

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added an option to disable OpenTelemetry span creation for individual auth instances

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic organization assignment via email domain to require both a verified provider domain and a verified stored user email, preventing social sign-in from joining an organization whose SSO provider merely claims that domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS resolution so callers can reload and retry.

For detailed changes, see CHANGELOG

@better-auth/sso

Bug Fixes

• Fixed automatic email-domain organization assignment to require both a verified provider domain and a verified user email, preventing social sign-in from granting access when an SSO provider merely claims a domain.

• Fixed domain verification to snapshot the provider's domains at request start, returning 409 with SSO_PROVIDER_CHANGED if the provider changes during DNS verification so callers can reload and retry.

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers

For detailed changes, see the CHANGELOG.

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call

For detailed changes, see CHANGELOG

auth

Bug Fixes

• Fixed the CLI to align installed packages with the running CLI version

For detailed changes, see CHANGELOG

better-auth

Bug Fixes

• Fixed session cleanup on user deletion to also remove sessions from secondary storage

• Fixed findSessions to skip invalid secondary-storage session entries without discarding other valid sessions

• Fixed email OTP sign-up to pass the verification type to custom OTP generators

• Fixed email OTP password reset to allow retrying after entering an invalid password

• Fixed email OTP verification to no longer reveal whether an email is registered before the OTP is verified

• Fixed jwtClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed JWT key minting inside database transactions to use the transaction-scoped adapter, preventing deadlocks on SQLite and ensuring keys commit with their surrounding transaction on Postgres and MySQL

• Fixed oAuthProxy to preserve Apple user data from form_post callbacks

• Fixed oneTapClient() collapsing createAuthClient type inference when combined with other client plugins

• Fixed database rate-limit cleanup to complete when no background task handler is configured

• Improved nextCookies performance in instrumented Next.js applications by reusing the next/headers import promise

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added a utility for creating stable, namespaced placeholder emails on the reserved placeholder.invalid domain

For detailed changes, see CHANGELOG

@better-auth/redis-storage

Bug Fixes

• Fixed listKeys() and clear() to use SCAN instead of KEYS so large keyspaces no longer block the Redis server

For detailed changes, see CHANGELOG