better-auth vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20253
3. 202636

Newest CVEs

• CVE-2026-121802

  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a…

  better-auth · Better Auth

  Critical9.1
• CVE-2026-114607

  better-auth: OAuth state can be used as a Magic Link to sign in as another user

  better-auth · better-auth

  Critical9.1
• CVE-2026-110864

  Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy

  better-auth · better-auth

  Critical9.1
• CVE-2026-110863

  Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

  better-auth · sso

  High8.6
• CVE-2026-110862

  Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

  better-auth · better-auth

  Critical9.3
• CVE-2026-110861

  Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

  better-auth · drizzle-adapter

  Medium6.3
• CVE-2026-109346

  better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

  better-auth · better-auth

  High8.5
• CVE-2026-80192

  better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

  better-auth · sso

  High8.6
• CVE-2025-71401

  better-auth before 1.4.2 basePath Modification DoS

  better-auth · better-auth

  Critical9.3
• CVE-2025-71400

  better-auth passkey before 1.4.0 IDOR via delete-passkey

  better-auth · passkey

  High7.1