Better Auth
Monthly
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). An attacker holding an org-owner role can either silently recruit users with matching email domains into an attacker-controlled organization by registering an unverified SSO provider, or exploit a race condition between verification and update endpoints to substitute a different domain after DNS proof is collected - which, combined with implicit account linking, enables effective account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider and mcp plugins, which advertise the 'none' signing algorithm in OIDC discovery and accept plain PKCE by default. Relying parties whose JWT libraries negotiate the algorithm from discovery metadata without pinning can be tricked into accepting unsigned ID tokens, while exposed authorization URLs allow interception of codes because plain PKCE offers no protection. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding valid primary credentials to access protected application routes without completing second-factor verification. The flaw stems from premature session caching: when session.cookieCache is enabled alongside 2FA, the session generated after primary sign-in is stored as fully valid before the second factor is checked, and subsequent lookups return the cached authenticated session without re-evaluating the 2FA requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is conceptually straightforward for any user or attacker who already possesses a valid username and password.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any victim account on applications that combine open email/password registration with the magic-link or email-OTP passwordless plugins. The attacker plants a password on the victim's email address before the legitimate owner ever signs in; when the owner later authenticates via the passwordless flow, the library verifies the account without clearing the pre-existing password or revoking pre-existing sessions, leaving the attacker's credentials valid. No public exploit identified at time of analysis, but the attack is mechanically trivial and requires only the ability to register an account - no special tooling, credentials, or network position needed.
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully take over another user's non-organization SCIM provider by exploiting a missing ownership binding. The root flaw (CWE-639) means provider rows are created without a userId by default, causing the access check to pass silently for any caller. An attacker with a valid session can regenerate a victim's SCIM bearer token, invalidating the legitimate token and authenticating to SCIM API routes with the attacker-controlled credential. No public exploit or KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low exploitation complexity for any authenticated user.
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, plus 1.7.0-beta.0/1.7.0-beta.1) lets any authenticated user register OAuth clients even when the clientPrivileges option was configured to gate the create action. The OAuth client creation endpoints (/oauth2/create-client and /admin/oauth2/create-client) never invoked the clientPrivileges hook before persisting new records, so restrictions on client registration were silently ineffective. Publicly available exploit code exists; EPSS is low (0.05%) and SSVC lists no observed exploitation, indicating limited real-world weaponization to date.
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base path when baseURL is not explicitly configured. By sending the very first request after server startup with crafted X-Forwarded-Host and X-Forwarded-Proto headers, the attacker forces every subsequent auth route to return 404 for all users until restart. A working reproduction (curl commands) is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing and no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in the better-auth passkey plugin (npm/@better-auth/passkey < 1.4.0) permits any authenticated user to delete arbitrary passkeys belonging to other users via the `POST /passkey/delete-passkey` endpoint. The `ctx.body.id` parameter is implicitly trusted without ownership verification, meaning a valid session - regardless of privilege level - is sufficient to enumerate and destroy other users' passkey credentials. Applications configured with `useNumberId` (auto-incrementing integer IDs) are trivially exploitable by sequential enumeration. No public exploit or CISA KEV listing confirmed at time of analysis; a vendor-released patch exists at version 1.4.0.
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPaths` security controls and path-based rate limits by submitting requests with extra leading slashes (e.g., `//sign-in/email` instead of `/sign-in/email`). The root cause is in the bundled rou3 router library, which collapses empty path segments before route matching, meaning security rules keyed on canonical paths never match the double-slash variants. No public exploit code has been identified at time of analysis, but the trivially low attack complexity makes exploitation straightforward on unprotected deployments.
Stored XSS in better-auth's deprecated oidc-provider and mcp plugins allows an attacker to register an OAuth client with a javascript: redirect_uri, which the authorization server stores and later returns unchanged in the consent response. If the deployment's consent page is a client-side component that assigns the returned redirectURI to window.location.href or equivalent, the attacker's JavaScript executes in the authorization-server origin - exposing the victim's session tokens and enabling account takeover. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 5.1 reflects required user interaction and limited subsequent-system impact, though deployments with unauthenticated dynamic client registration face elevated real-world risk.
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days after account removal. Affected are deployments of better-auth versions 0.3.4 through 1.6.10 running with secondaryStorage (Redis, KV, or similar external cache) and the default storeSessionInDatabase=false setting, where user deletion flows through the admin, anonymous, or SCIM plugins. Because deleteSessions is never called before deleteUser in these code paths, the session payload remains live in the cache until TTL expiry, meaning a terminated employee or compromised account that has been administratively deleted can continue making authenticated requests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover when a victim follows a crafted link. The trustedOrigins validation logic - responsible for gatekeeping callbackURL parameters - contains bypass flaws in both its absolute URL matching and wildcard domain pattern handling, allowing an attacker-supplied URL to pass origin checks and redirect victims to an attacker-controlled destination. Because callback redirects in authentication flows commonly carry sensitive tokens such as password-reset credentials, a successful redirect exfiltrates those tokens and allows full account compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser when a user visits an attacker-crafted URL containing a malicious 'error' query parameter that is reflected as unsanitized HTML. All npm releases of better-auth from version 0.0.2 up to (but not including) 1.1.16 are affected, spanning virtually the entire release history of the library. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the attack surface is inherently internet-accessible and requires only social engineering to trigger.
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback state parameter and supply attacker-controlled authorization codes, creating authenticated sessions in the victim's browser that are cryptographically bound to the attacker's external identity. Account-linking flows are equally exposed, permitting the attacker's provider account to be persistently linked to an authenticated victim row in the application's user store. Exploitation is constrained to a specific non-default configuration (cookie-backed state storage with PKCE disabled), and no public exploit has been identified at time of analysis.
Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted `_multi-*` cookie to the /sign-out after-hook, which forwards cookie values to `internalAdapter.deleteSessions()` without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.
Path traversal in better-auth/better-icons (versions up to and including 1.0.5) allows a local low-privileged attacker to manipulate the icons_file argument passed to the scan_project_icons/sync_icon component, escaping the intended directory boundary to read or write arbitrary files accessible to the process. A public proof-of-concept has been disclosed via GitHub issue #18, and the vendor has not yet responded to the responsible disclosure. No CISA KEV listing exists; the CVSS 4.0 base score of 1.9 correctly reflects the constrained local-only attack surface and limited per-file impact.
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Better Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). An attacker holding an org-owner role can either silently recruit users with matching email domains into an attacker-controlled organization by registering an unverified SSO provider, or exploit a race condition between verification and update endpoints to substitute a different domain after DNS proof is collected - which, combined with implicit account linking, enables effective account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider and mcp plugins, which advertise the 'none' signing algorithm in OIDC discovery and accept plain PKCE by default. Relying parties whose JWT libraries negotiate the algorithm from discovery metadata without pinning can be tricked into accepting unsigned ID tokens, while exposed authorization URLs allow interception of codes because plain PKCE offers no protection. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding valid primary credentials to access protected application routes without completing second-factor verification. The flaw stems from premature session caching: when session.cookieCache is enabled alongside 2FA, the session generated after primary sign-in is stored as fully valid before the second factor is checked, and subsequent lookups return the cached authenticated session without re-evaluating the 2FA requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is conceptually straightforward for any user or attacker who already possesses a valid username and password.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any victim account on applications that combine open email/password registration with the magic-link or email-OTP passwordless plugins. The attacker plants a password on the victim's email address before the legitimate owner ever signs in; when the owner later authenticates via the passwordless flow, the library verifies the account without clearing the pre-existing password or revoking pre-existing sessions, leaving the attacker's credentials valid. No public exploit identified at time of analysis, but the attack is mechanically trivial and requires only the ability to register an account - no special tooling, credentials, or network position needed.
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully take over another user's non-organization SCIM provider by exploiting a missing ownership binding. The root flaw (CWE-639) means provider rows are created without a userId by default, causing the access check to pass silently for any caller. An attacker with a valid session can regenerate a victim's SCIM bearer token, invalidating the legitimate token and authenticating to SCIM API routes with the attacker-controlled credential. No public exploit or KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low exploitation complexity for any authenticated user.
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to register an attacker-controlled OIDC or SAML identity provider for the organization, bypassing the admin role check. This can be exploited to inject a malicious IdP and, through downstream SSO callback provisioning, add users to the target organization, potentially with elevated privileges if the default role is admin. The vulnerability is fixed in version 1.6.11; no active exploitation is currently reported but a public exploit is possible given the clear advisory details.
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, plus 1.7.0-beta.0/1.7.0-beta.1) lets any authenticated user register OAuth clients even when the clientPrivileges option was configured to gate the create action. The OAuth client creation endpoints (/oauth2/create-client and /admin/oauth2/create-client) never invoked the clientPrivileges hook before persisting new records, so restrictions on client registration were silently ineffective. Publicly available exploit code exists; EPSS is low (0.05%) and SSVC lists no observed exploitation, indicating limited real-world weaponization to date.
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base path when baseURL is not explicitly configured. By sending the very first request after server startup with crafted X-Forwarded-Host and X-Forwarded-Proto headers, the attacker forces every subsequent auth route to return 404 for all users until restart. A working reproduction (curl commands) is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing and no public exploit identified as being used in active attacks.
Insecure Direct Object Reference in the better-auth passkey plugin (npm/@better-auth/passkey < 1.4.0) permits any authenticated user to delete arbitrary passkeys belonging to other users via the `POST /passkey/delete-passkey` endpoint. The `ctx.body.id` parameter is implicitly trusted without ownership verification, meaning a valid session - regardless of privilege level - is sufficient to enumerate and destroy other users' passkey credentials. Applications configured with `useNumberId` (auto-incrementing integer IDs) are trivially exploitable by sequential enumeration. No public exploit or CISA KEV listing confirmed at time of analysis; a vendor-released patch exists at version 1.4.0.
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPaths` security controls and path-based rate limits by submitting requests with extra leading slashes (e.g., `//sign-in/email` instead of `/sign-in/email`). The root cause is in the bundled rou3 router library, which collapses empty path segments before route matching, meaning security rules keyed on canonical paths never match the double-slash variants. No public exploit code has been identified at time of analysis, but the trivially low attack complexity makes exploitation straightforward on unprotected deployments.
Stored XSS in better-auth's deprecated oidc-provider and mcp plugins allows an attacker to register an OAuth client with a javascript: redirect_uri, which the authorization server stores and later returns unchanged in the consent response. If the deployment's consent page is a client-side component that assigns the returned redirectURI to window.location.href or equivalent, the attacker's JavaScript executes in the authorization-server origin - exposing the victim's session tokens and enabling account takeover. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 5.1 reflects required user interaction and limited subsequent-system impact, though deployments with unauthenticated dynamic client registration face elevated real-world risk.
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days after account removal. Affected are deployments of better-auth versions 0.3.4 through 1.6.10 running with secondaryStorage (Redis, KV, or similar external cache) and the default storeSessionInDatabase=false setting, where user deletion flows through the admin, anonymous, or SCIM plugins. Because deleteSessions is never called before deleteUser in these code paths, the session payload remains live in the cache until TTL expiry, meaning a terminated employee or compromised account that has been administratively deleted can continue making authenticated requests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover when a victim follows a crafted link. The trustedOrigins validation logic - responsible for gatekeeping callbackURL parameters - contains bypass flaws in both its absolute URL matching and wildcard domain pattern handling, allowing an attacker-supplied URL to pass origin checks and redirect victims to an attacker-controlled destination. Because callback redirects in authentication flows commonly carry sensitive tokens such as password-reset credentials, a successful redirect exfiltrates those tokens and allows full account compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser when a user visits an attacker-crafted URL containing a malicious 'error' query parameter that is reflected as unsanitized HTML. All npm releases of better-auth from version 0.0.2 up to (but not including) 1.1.16 are affected, spanning virtually the entire release history of the library. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the attack surface is inherently internet-accessible and requires only social engineering to trigger.
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback state parameter and supply attacker-controlled authorization codes, creating authenticated sessions in the victim's browser that are cryptographically bound to the attacker's external identity. Account-linking flows are equally exposed, permitting the attacker's provider account to be persistently linked to an authenticated victim row in the application's user store. Exploitation is constrained to a specific non-default configuration (cookie-backed state storage with PKCE disabled), and no public exploit has been identified at time of analysis.
Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted `_multi-*` cookie to the /sign-out after-hook, which forwards cookie values to `internalAdapter.deleteSessions()` without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.
Path traversal in better-auth/better-icons (versions up to and including 1.0.5) allows a local low-privileged attacker to manipulate the icons_file argument passed to the scan_project_icons/sync_icon component, escaping the intended directory boundary to read or write arbitrary files accessible to the process. A public proof-of-concept has been disclosed via GitHub issue #18, and the vendor has not yet responded to the responsible disclosure. No CISA KEV listing exists; the CVSS 4.0 base score of 1.9 correctly reflects the constrained local-only attack surface and limited per-file impact.
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Better Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.