Vendor
Better-auth
39 known vulnerabilities in products by Better-auth, 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-61928 | Better Auth: Unauthenticated API key creation through api-key plugin | — | |
| Critical | CVE-2026-67330 | better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision | 9.9 | |
| Critical | CVE-2026-114607 | better-auth: OAuth state can be used as a Magic Link to sign in as another user | 9.1 | |
| High | CVE-2025-71399 | Better Auth before 1.4.5 Path Normalization Bypass via rou3 | 8.6 | |
| Critical | CVE-2026-110862 | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link | 9.1 | |
| Critical | CVE-2025-71401 | better-auth before 1.4.2 basePath Modification DoS | 5.9 | |
| High | CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSO | 8.1 | |
| Critical | CVE-2026-110864 | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy | 7.4 | |
| High | CVE-2026-67327 | better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP | 8.3 | |
| High | CVE-2026-110863 | Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers | 8.1 | |
| High | CVE-2026-109346 | better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device | 8.1 | |
| High | CVE-2026-80192 | better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass | 8.1 | |
| High | CVE-2026-67331 | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass | 8.3 | |
| High | CVE-2026-53517 | Better-auth: Time-of-check Time-of-use (TOCTOU) Race Condition | 8.1 | |
| High | CVE-2026-53518 | Better-auth: Time-of-check Time-of-use (TOCTOU) Race Condition | 8.1 | |
| Critical | CVE-2026-53513 | Better-auth: Server-Side Request Forgery (SSRF) | 9.6 | |
| Critical | CVE-2026-67336 | better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider | 8.7 | |
| High | CVE-2026-67337 | better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache | 6.5 | |
| Critical | CVE-2026-53512 | Better-auth: Missing Authentication for Critical Function | 9.1 | |
| High | CVE-2026-53515 | Better-auth: Improper Privilege Management | 7.1 | |
| High | CVE-2026-53516 | Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email | 8.3 | |
| High | CVE-2025-71400 | better-auth passkey before 1.4.0 IDOR via delete-passkey | 7.1 | |
| High | CVE-2025-71403 | better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass | 7.1 | |
| Medium | CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | — | |
| Medium | CVE-2026-110861 | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition | 3.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
Products
| Better-auth | 40 | 0 |
| Sso | 5 | 0 |
| Better-auth\/oauth-provider | 3 | 0 |
| Oauth-provider | 3 | 0 |