better-auth vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-114607 Better Auth is an authentication and authorization library for TypeScript.Critical 9.1 · Oct 22, 2026
• CVE-2026-110864 Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sCritical 9.1 · Oct 14, 2026
• CVE-2026-110863 Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other usHigh 8.6 · Oct 14, 2026
• CVE-2026-110862 Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by rCritical 9.3 · Oct 14, 2026
• CVE-2026-109346 better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the reHigh 8.5 · Oct 12, 2026
• CVE-2026-80192 @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws.High 8.6 · Aug 26, 2026
• CVE-2025-71401 better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset).Critical 9.3 · Aug 2, 2026
• CVE-2025-71400 better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated uHigh 7.1 · Aug 2, 2026
• CVE-2025-71399 Better Auth relies on better-call, which uses the rou3 router library.High 8.8 · Aug 2, 2026
• CVE-2026-67337 better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled.High 7.1 · Aug 1, 2026
• CVE-2026-67336 better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plaiCritical 9.4 · Aug 1, 2026
• CVE-2026-67331 better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users High 8.7 · Aug 1, 2026
• CVE-2026-67330 @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypassCritical 9.4 · Aug 1, 2026
• CVE-2026-67329 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actioHigh 7.1 · Aug 1, 2026
• CVE-2026-67328 @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitHigh 8.6 · Aug 1, 2026
• CVE-2026-67327 better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijHigh 8.7 · Aug 1, 2026
• CVE-2025-71403 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains.High 7.1 · Aug 1, 2026
• CVE-2026-53518 Better Auth is an authentication and authorization library for TypeScript.High 7.6 · Jul 15, 2026
• CVE-2026-53517 Better Auth is an authentication and authorization library for TypeScript.High 8.1 · Jul 15, 2026
• CVE-2026-53516 Better Auth is an authentication and authorization library for TypeScript.High 8.3 · Jul 15, 2026
• CVE-2026-53515 Better Auth is an authentication and authorization library for TypeScript.High 7.1 · Jul 15, 2026
• CVE-2026-53514 Better Auth is an authentication and authorization library for TypeScript.High 7.7 · Jul 15, 2026
• CVE-2026-53513 Better Auth is an authentication and authorization library for TypeScript.Critical 9.6 · Jul 15, 2026
• CVE-2026-53512 Better Auth is an authentication and authorization library for TypeScript.Critical 9.1 · Jul 15, 2026
• CVE-2026-45337 Better Auth is an authentication and authorization library for TypeScript.High 7.6 · Jul 15, 2026