Login Request a demo
BE
Vendor
better-auth
11 products with CVEs on record
50
CVEs
0
On KEV
8
New 30D
Products
BE
better-auth
better-auth
9.6
30 CVEs0 on KEV5 new
SS
sso
better-auth
9.6
5 CVEs0 on KEV1 new
DR
drizzle-adapter
better-auth
3.7
1 CVEs0 on KEV1 new
KY
kysely-adapter
better-auth
3.7
1 CVEs0 on KEV1 new
BE
Better-auth/oauth-provider
Better-auth
8.1
3 CVEs0 on KEV0 new
OA
oauth-provider
better-auth
8.1
3 CVEs0 on KEV0 new
BE
Better-auth/sso
Better-auth
9.6
2 CVEs0 on KEV0 new
SC
scim
better-auth
9.9
2 CVEs0 on KEV0 new
BE
better-icons
better-auth
5.3
1 CVEs0 on KEV0 new
PA
passkey
better-auth
7.1
1 CVEs0 on KEV0 new
ST
stripe
better-auth
7.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-114607
New
BE
better-auth
better-auth
9.1
0%
Oct 22better-auth: OAuth state can be used as a Magic Link to sign in as another user
CVE-2026-110864
BE
better-auth
better-auth
7.4
0%
Oct 14Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
CVE-2026-110863
SS
sso
better-auth
8.1
0%
Oct 14Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
CVE-2026-110862
BE
better-auth
better-auth
9.1
0%
Oct 14Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
CVE-2026-110861
KY
kysely-adapter
better-auth
3.7
0%
Oct 14Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
CVE-2026-109346
BE
better-auth
better-auth
8.1
0%
Oct 12better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
CVE-2026-80192
SS
sso
better-auth
8.1
0%
Aug 25better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
CVE-2025-71401
BE
better-auth
better-auth
5.9
0%
Aug 2better-auth before 1.4.2 basePath Modification DoS
CVE-2025-71400
PA
passkey
better-auth
7.1
0%
Aug 2better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2025-71399
BE
better-auth
better-auth
8.6
1%
Aug 2Better Auth before 1.4.5 Path Normalization Bypass via rou3
CVE-2026-67336
BE
better-auth
better-auth
8.7
0%
Aug 1better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
CVE-2026-67333
BE
better-auth
better-auth
7.2
0%
Aug 1better-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-67329
ST
stripe
better-auth
7.1
0%
Aug 1@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2026-67334
BE
better-auth
better-auth
3.8
0%
Aug 1better-auth Stale Sessions Persist After User Deletion
CVE-2025-71403
BE
better-auth
better-auth
7.1
0%
Aug 1better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2026-67332
OA
oauth-provider
better-auth
6.4
0%
Aug 1@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67337
BE
better-auth
better-auth
6.5
0%
Aug 1better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
CVE-2026-67328
SS
sso
better-auth
8.1
0%
Aug 1@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2025-71404
BE
better-auth
better-auth
5.1
1%
Aug 1better-auth before 1.1.16 Reflected XSS via error parameter
CVE-2026-67327
BE
better-auth
better-auth
8.3
0%
Aug 1better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-67331
SC
scim
better-auth
8.3
0%
Aug 1better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67335
BE
better-auth
better-auth
5.3
0%
Aug 1better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2026-67330
SC
scim
better-auth
9.9
1%
Aug 1better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
CVE-2025-71402
BE
better-auth
better-auth
2.0
0%
Aug 1better-auth before 1.4.0 Session Revocation via Forged Cookie
CVE-2026-53517
BE
better-auth
better-auth
8.1
0%
Jul 15Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
CVE-2026-45337
BE
better-auth
better-auth
7.6
0%
Jul 15Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
CVE-2026-53514
BE
better-auth
better-auth
7.7
0%
Jul 15Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
CVE-2026-53515
SS
sso
@better-auth
7.1
0%
Jul 15Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
CVE-2026-53512
BE
better-auth
better-auth
9.1
0%
Jul 15Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
CVE-2026-53518
BE
better-auth
better-auth
8.1
0%
Jul 15Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
CVE-2026-53513
BE
better-auth
better-auth
9.6
0%
Jul 15Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
CVE-2026-53516
BE
better-auth
better-auth
8.3
0%
Jul 15Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
CVE-2026-15527
BE
better-icons
better-auth
5.3
0%
Jul 13better-auth better-icons scan_project_icons/sync_icon path traversal
CVE-2026-45364
BE
better-auth
better-auth
7.3
0%
May 28Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
CVE-2026-41427
OA
oauth-provider
better-auth
6.5
0%
Apr 24Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
CVE-2025-61928
BE
better-auth
better-auth
9.3
19%
Oct 9Better Auth: Unauthenticated API key creation through api-key plugin
CVE-2025-53535
BE
better-auth
better-auth
2.1
0%
Jul 7Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
CVE-2025-27143
BA
Better Auth
Better-auth
6.1
0%
Feb 24Better Auth is an authentication and authorization library for TypeScript
CVE-2024-56734
BE
better-auth
better-auth
6.1
0%
Dec 30Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint