Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Better Auth: Unauthenticated API key creation through api-key plugin

better-auth: OAuth state can be used as a Magic Link to sign in as another user

Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Better Auth before 1.4.5 Path Normalization Bypass via rou3

better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email

better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption

Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

better-auth before 1.6.13 Stored XSS via javascript redirect_uri

better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso

better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache

Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients

Better Auth is an authentication and authorization library for TypeScript

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

better-auth before 1.4.2 basePath Modification DoS

better-auth before 1.6.2 OAuth State Validation Bypass

better-auth before 1.1.16 Reflected XSS via error parameter

better-auth Stale Sessions Persist After User Deletion

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

better-auth before 1.4.0 Session Revocation via Forged Cookie