Login Request a demo
BE
Product
better-auth
by better-auth · last CVE Oct 22, 2026
30
CVEs
0
On KEV
9.6
Max CVSS
5
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 5High 14Medium 7Low 4
Severity
All severities30Critical5High14Medium7Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add better-auth to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-53513
9.6
0%
Jul 15
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
Affected: >= 0.1.0, < 1.6.11
CVE-2025-61928
9.3
19%
Oct 9
Better Auth: Unauthenticated API key creation through api-key plugin
Affected: < 1.3.26
CVE-2026-114607
New
9.1
0%
Oct 22
better-auth: OAuth state can be used as a Magic Link to sign in as another user
Affected: >= 1.4.0-beta.18, < 1.7.7
CVE-2026-110862
9.1
0%
Oct 14
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Affected: 1.4.0-beta.18 before 1.7.7
CVE-2026-53512
9.1
0%
Jul 15
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Affected: < 1.6.11
Showing 5