BE
Product
better-auth
30
CVEs
0
On KEV
9.6
Max CVSS
5
New 30D
Severity mix
Critical 5High 14Medium 7Low 4
Watch
Add better-auth to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-67336 | 8.7 | Aug 1 | better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider Affected: before 1.6.11 |
| CVE-2025-71399 | 8.6 | Aug 2 | Better Auth before 1.4.5 Path Normalization Bypass via rou3 Affected: before 1.4.5 |
| CVE-2026-67327 | 8.3 | Aug 1 | better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP Affected: 1.1.3 before 1.6.22; 1.7.0-beta.0 before 1.7.0-beta.10 |
| CVE-2026-53516 | 8.3 | Jul 15 | Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email Affected: < 1.6.11 |
| CVE-2026-109346 | 8.1 | Oct 12 | better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device Affected: 1.3.8-beta.3 before 1.7.0-rc.3 |
| CVE-2026-53517 | 8.1 | Jul 15 | Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking Affected: >= 1.4.8-beta.7, < 1.6.0 |
| CVE-2026-53518 | 8.1 | Jul 15 | Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption Affected: >= 1.6.0, < 1.6.11 |
| CVE-2026-53514 | 7.7 | Jul 15 | Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin Affected: < 1.6.11 |
| CVE-2026-45337 | 7.6 | Jul 15 | Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending Affected: >= 1.6.0, < 1.6.11 |
| CVE-2026-110864 | 7.4 | Oct 14 | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy Affected: 1.5.0-beta.12 before 1.7.7 |
| CVE-2026-45364 | 7.3 | May 28 | Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation Affected: < 1.4.17; >= 1.5.0-beta.1, < 1.5.0-beta.9 |
| CVE-2026-67333 | 7.2 | Aug 1 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri Affected: before 1.6.13; 1.7.0-beta.0 before 1.7.0-beta.4 |
| CVE-2025-71403 | 7.1 | Aug 1 | better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass Affected: before 1.1.20 |
| CVE-2026-53515 | 7.1 | Jul 15 | Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso Affected: >= 1.2.10, < 1.6.11 |
Showing 14