better-auth

Top products

The 15 most recently published vulnerabilities affecting better-auth.

• CVE-2025-71401better-auth before 1.4.2 basePath Modification DoS5.9Aug 2, 2026
• CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkey7.1Aug 2, 2026
• CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou38.6Aug 2, 2026
• CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass6.4Aug 1, 2026
• CVE-2026-67334better-auth Stale Sessions Persist After User Deletion3.8Aug 1, 2026
• CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription7.1Aug 1, 2026
• CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache6.5Aug 1, 2026
• CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_uri7.2Aug 1, 2026
• CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider8.7Aug 1, 2026
• CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass7.1Aug 1, 2026
• CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP8.3Aug 1, 2026
• CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass8.3Aug 1, 2026
• CVE-2026-67328@better-auth/sso before 1.6.21 Account Takeover via SSO8.1Aug 1, 2026
• CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypass5.3Aug 1, 2026
• CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision9.9Aug 1, 2026