CVEs we hold for Better-auth

Records whose assigning authority named Better-auth as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-80192better-auth SSO before 1.6.27 Domain Ownership Authentication Bypassbetter-auth sso

CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachebetter-auth

CVE-2026-67336better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderbetter-auth

CVE-2026-67335better-auth before 1.6.2 OAuth State Validation Bypassbetter-auth

CVE-2026-67334better-auth Stale Sessions Persist After User Deletionbetter-auth

CVE-2026-67333better-auth before 1.6.13 Stored XSS via javascript redirect_uribetter-auth

CVE-2026-67332@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypassbetter-auth oauth-provider

CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassbetter-auth scim

CVE-2026-67330better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionbetter-auth scim

CVE-2026-67329@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionbetter-auth stripe

CVE-2026-67328@better-auth/sso before 1.6.21 Account Takeover via SSObetter-auth sso

CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPbetter-auth

CVE-2026-53518Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemptionbetter-auth

CVE-2026-53517Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forkingbetter-auth; @better-auth oauth-provider

CVE-2026-53516Better Auth: Account takeover via OAuth auto-link to unverified pre-registered emailbetter-auth

CVE-2026-53515Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/ssobetter-auth; @better-auth sso

CVE-2026-53514Better Auth: Unauthorized invitation acceptance via unverified email match in organization pluginbetter-auth

CVE-2026-53513Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registrationbetter-auth; @better-auth sso

CVE-2026-53512Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsbetter-auth

CVE-2026-45364Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationbetter-auth

CVE-2026-45337Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingbetter-auth

CVE-2026-41427Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clientsbetter-auth; better-auth oauth-provider

CVE-2026-15527better-auth better-icons scan_project_icons/sync_icon path traversalbetter-auth better-icons

CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameterbetter-auth

CVE-2025-71403better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassbetter-auth

CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookiebetter-auth

CVE-2025-71401better-auth before 1.4.2 basePath Modification DoSbetter-auth

CVE-2025-71400better-auth passkey before 1.4.0 IDOR via delete-passkeybetter-auth passkey

CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3better-auth

CVE-2025-61928Better Auth: Unauthenticated API key creation through api-key pluginbetter-auth

CVE-2025-53535Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routesbetter-auth

CVE-2025-27143Beter Auth has an Open Redirect via Scheme-Less Callback Parameterbetter-auth

CVE-2024-56734Better Auth has an Open Redirect Vulnerability in Verify Email Endpointbetter-auth

33 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.