BE
Product
better-auth
30
CVEs
0
On KEV
9.6
Max CVSS
5
New 30D
Severity mix
Critical 5High 14Medium 7Low 4
Watch
Add better-auth to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-67337 | 6.5 | Aug 1 | better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache Affected: before 1.4.9 |
| CVE-2026-41427 | 6.5 | Apr 24 | Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients Affected: >= 1.4.8-beta.7, < 1.6.5; >= 1.7.0-beta.0, <= 1.7.0-beta.1 |
| CVE-2025-27143 | 6.1 | Feb 24 | Better Auth is an authentication and authorization library for TypeScript Affected: before 1.1.21 |
| CVE-2024-56734 | 6.1 | Dec 30 | Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint Affected: < 1.1.5 |
| CVE-2025-71401 | 5.9 | Aug 2 | better-auth before 1.4.2 basePath Modification DoS Affected: before 1.4.2 |
| CVE-2026-67335 | 5.3 | Aug 1 | better-auth before 1.6.2 OAuth State Validation Bypass Affected: before 1.6.2 |
| CVE-2025-71404 | 5.1 | Aug 1 | better-auth before 1.1.16 Reflected XSS via error parameter Affected: before 1.1.16 |
Showing 7