better-auth

1.7.12 · 20 Oct 2026MIT7.8M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for better-auth. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	1.7.12	Safe from 1.6.22
	0.8.8	159 open advisories, worst critical · last release Nov 2024, no longer updated

Your version

Critical
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsGHSA-pw9m-5jxm-xr6h · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.11
Critical
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)GHSA-xg6x-h9c9-2m83 · 3 Apr 2026
- 1.x1.0.0 – 1.4.8Fixed in 1.4.9
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.4.9
High
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-inGHSA-qq9h-g4jm-xgf3 · 24 Jul 2026
- 1.x1.1.3 – 1.6.21Fixed in 1.6.22
High
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitiveGHSA-7w99-5wm4-3g79 · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.11
High
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemptionGHSA-392p-2q2v-4372 · 7 Jul 2026
- 1.x1.4.8 – 1.5.6Fixed in 1.6.0
High
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by defaultGHSA-9h47-pqcx-hjr4 · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.11
High
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcpGHSA-86j7-9j95-vpqj · 7 Jul 2026
- 1.x1.0.0 – 1.6.12Fixed in 1.6.13
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.13
High
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered emailGHSA-g38m-r43w-p2q7 · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.11
High
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization pluginGHSA-fmh4-wcc4-5jm3 · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.11
High
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingGHSA-cq3f-vc6p-68fh · 4 Jun 2026
- 1.x1.6.0 – 1.6.10Fixed in 1.6.11
High
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationGHSA-p6v2-xcpg-h6xw · 15 May 2026
- 1.x1.0.0 – 1.4.16Fixed in 1.4.17
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.4.17
High
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate LimitsGHSA-x732-6j76-qmhm · 16 Dec 2025
- 1.x1.0.0 – 1.4.4Fixed in 1.4.5
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.4.5
High
Better Auth affected by external request basePath modification DoSGHSA-569q-mpph-wgww · 1 Dec 2025
- 1.x1.0.0 – 1.4.1Fixed in 1.4.2
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.4.2
High
Better Auth: Unauthenticated API key creation through api-key pluginGHSA-99h5-pjcv-gr6v · 9 Oct 2025
- 1.x1.0.0 – 1.3.25Fixed in 1.3.26
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.3.26
High
Better Auth allows bypassing the trustedOrigins Protection which leads to ATOGHSA-vp58-j275-797x · 24 Feb 2025
- 1.x1.0.0 – 1.1.20Fixed in 1.1.21
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.1.21
High
Better Auth has an Open Redirect Vulnerability in Verify Email EndpointGHSA-8jhw-6pjj-8723 · 30 Dec 2024
- 1.x1.0.0 – 1.1.5Fixed in 1.1.6
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.1.6
Moderate
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCEGHSA-wxw3-q3m9-c3jr · 15 May 2026
- 1.x1.0.0 – 1.6.1Fixed in 1.6.2
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.6.2
Moderate
Beter Auth has an Open Redirect via Scheme-Less Callback ParameterGHSA-hjpm-7mrm-26w8 · 24 Feb 2025
- 1.x1.0.0 – 1.1.19Fixed in 1.1.20
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.1.20
Moderate
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)GHSA-9x4v-xfq5-m8x5 · 5 Feb 2025
- 1.x1.0.0 – 1.1.15Fixed in 1.1.16
- 0.8.x and older0.0.2 – 0.8.8No fix, no longer updated · move to 1.1.16
Low
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flowsGHSA-2vg6-77g8-24mp · 7 Jul 2026
- 1.x1.0.0 – 1.6.10Fixed in 1.6.11
- 0.8.x and older0.3.4 – 0.8.8No fix, no longer updated · move to 1.6.11
Low
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessionsGHSA-wmjr-v86c-m9jj · 26 Nov 2025
- 1.x1.3.34Fixed in 1.4.0
Low
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple RoutesGHSA-36rg-gfq2-3h56 · 7 Jul 2025
- 1.x1.0.0 – 1.2.9Fixed in 1.2.10
- 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated · move to 1.2.10

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.