{"kind": "product", "path": "vulns/npm/better-auth", "name": "better-auth", "product": "better-auth", "ecosystem": "npm", "items": [{"id": "CVE-2026-110864", "noindex": false, "published": "2026-10-14T22:52:51.393Z", "modified": "2026-10-15T15:36:16.330Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00288, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-110864", "title": "Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy", "description": "Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf", "https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy", "https://nvd.nist.gov/vuln/detail/CVE-2026-110864"], "fixes": ["1.7.7"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-110862", "noindex": false, "published": "2026-10-14T22:52:46.811Z", "modified": "2026-10-15T13:34:05.213Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-110862", "title": "Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link", "description": "Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm", "https://www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link", "https://nvd.nist.gov/vuln/detail/CVE-2026-110862"], "fixes": ["1.7.7"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-110861", "noindex": false, "published": "2026-10-14T22:52:45.713Z", "modified": "2026-10-20T02:26:30.363Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00217, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-110861", "title": "Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition", "description": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf", "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition", "https://nvd.nist.gov/vuln/detail/CVE-2026-110861"], "fixes": ["1.7.7"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-109346", "noindex": false, "published": "2026-10-12T16:05:30.595Z", "modified": "2026-10-26T16:46:48.047Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-109346", "title": "better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device", "description": "better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm", "https://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device", "https://nvd.nist.gov/vuln/detail/CVE-2026-109346"], "fixes": ["1.7.0-rc.3"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2025-71401", "noindex": false, "published": "2026-08-02T12:15:23.707Z", "modified": "2026-08-03T14:29:35.454Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-71401", "title": "better-auth before 1.4.2 basePath Modification DoS", "description": "better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww", "https://www.vulncheck.com/advisories/better-auth-before-basepath-modification-dos", "https://nvd.nist.gov/vuln/detail/CVE-2025-71401"], "fixes": ["1.4.2"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2025-71399", "noindex": false, "published": "2026-08-02T12:15:22.129Z", "modified": "2026-10-08T15:21:31.928Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0052, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-71399", "title": "Better Auth before 1.4.5 Path Normalization Bypass via rou3", "description": "Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-x732-6j76-qmhm", "https://github.com/better-auth/better-auth/commit/f60b43fa648399534507c9ac7db36d705b8874c3", "https://www.vulncheck.com/advisories/better-auth-before-path-normalization-bypass-via-rou3"], "fixes": ["1.4.5"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67336", "noindex": false, "published": "2026-08-01T12:22:18.271Z", "modified": "2026-08-03T15:23:44.055Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "severity": "critical", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67336", "title": "better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider", "description": "better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4", "https://www.vulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider", "https://nvd.nist.gov/vuln/detail/CVE-2026-67336"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67333", "noindex": false, "published": "2026-08-01T12:22:18.167Z", "modified": "2026-08-03T19:43:05.018Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00263, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67333", "title": "better-auth before 1.6.13 Stored XSS via javascript redirect_uri", "description": "better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-86j7-9j95-vpqj", "https://www.vulncheck.com/advisories/better-auth-before-stored-xss-via-javascript-redirect-uri", "https://nvd.nist.gov/vuln/detail/CVE-2026-67333"], "fixes": ["1.6.13", "1.7.0-beta.4"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}, {"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67334", "noindex": false, "published": "2026-08-01T12:22:18.107Z", "modified": "2026-10-08T15:24:12.360Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00323, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67334", "title": "better-auth Stale Sessions Persist After User Deletion", "description": "better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mp", "https://www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-user-deletion", "https://nvd.nist.gov/vuln/detail/CVE-2026-67334"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2025-71403", "noindex": false, "published": "2026-08-01T12:22:18.102Z", "modified": "2026-08-03T18:18:54.122Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00342, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-71403", "title": "better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass", "description": "better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x", "https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2025-71403"], "fixes": ["1.1.21"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67337", "noindex": false, "published": "2026-08-01T12:22:18.034Z", "modified": "2026-08-03T18:31:13.051Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00462, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67337", "title": "better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache", "description": "better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83", "https://www.vulncheck.com/advisories/better-auth-before-two-factor-authentication-bypass-via-session-cookiecache", "https://nvd.nist.gov/vuln/detail/CVE-2026-67337"], "fixes": ["1.4.9"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2025-71404", "noindex": false, "published": "2026-08-01T12:22:17.885Z", "modified": "2026-08-03T15:38:00.141Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00521, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-71404", "title": "better-auth before 1.1.16 Reflected XSS via error parameter", "description": "better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5", "https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c", "https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter"], "fixes": ["1.1.16"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67327", "noindex": false, "published": "2026-08-01T12:22:17.753Z", "modified": "2026-08-03T18:29:37.617Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67327", "title": "better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP", "description": "better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access t", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-qq9h-g4jm-xgf3", "https://www.vulncheck.com/advisories/better-auth-before-account-takeover-via-magic-link-email-otp", "https://nvd.nist.gov/vuln/detail/CVE-2026-67327"], "fixes": ["1.6.22", "1.7.0-beta.10"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}, {"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-67335", "noindex": false, "published": "2026-08-01T12:22:17.178Z", "modified": "2026-08-03T15:38:08.522Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00283, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-67335", "title": "better-auth before 1.6.2 OAuth State Validation Bypass", "description": "better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-wxw3-q3m9-c3jr", "https://www.vulncheck.com/advisories/better-auth-before-oauth-state-validation-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-67335"], "fixes": ["1.6.2"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2025-71402", "noindex": false, "published": "2026-08-01T12:22:16.655Z", "modified": "2026-08-03T19:32:01.754Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.00268, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-71402", "title": "better-auth before 1.4.0 Session Revocation via Forged Cookie", "description": "better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj", "https://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie", "https://nvd.nist.gov/vuln/detail/CVE-2025-71402"], "fixes": ["1.4.0"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-53517", "noindex": false, "published": "2026-07-15T17:33:38.943Z", "modified": "2026-07-15T19:21:22.553Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00422, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53517", "title": "Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking", "description": "Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372", "https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"], "fixes": ["1.6.0"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-45337", "noindex": false, "published": "2026-07-15T17:31:44.983Z", "modified": "2026-07-15T18:02:58.506Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-45337", "title": "Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending", "description": "Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh", "https://github.com/better-auth/better-auth/pull/9573", "https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-53514", "noindex": false, "published": "2026-07-15T17:30:46.069Z", "modified": "2026-07-18T01:13:02.175Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00201, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53514", "title": "Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin", "description": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default b", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-fmh4-wcc4-5jm3", "https://github.com/better-auth/better-auth/pull/9577", "https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-53512", "noindex": false, "published": "2026-07-15T17:18:09.512Z", "modified": "2026-07-18T01:08:08.419Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53512", "title": "Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins", "description": "Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-pw9m-5jxm-xr6h", "https://github.com/better-auth/better-auth/pull/9576", "https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}, {"id": "CVE-2026-53518", "noindex": false, "published": "2026-07-15T17:17:06.410Z", "modified": "2026-07-15T18:07:49.190Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00409, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53518", "title": "Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption", "description": "Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.", "references": ["https://github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g79", "https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9", "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"], "fixes": ["1.6.11"], "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}]}], "total": 26, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "better-auth", "path": "vulns/npm/better-auth", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-26T16:46:48.047Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}