Better-auth
Better-auth Better Auth: vulnerabilidades y CVE
Better-auth Better Auth tiene 14 vulnerabilidades publicadas, 11 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses11
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-71399 | Alta (8.8) | 0.52% | — | 2 ago 2026 | Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better… |
| CVE-2026-53518 | Alta (7.6) | 0.41% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use… |
| CVE-2026-53517 | Alta (8.1) | 0.42% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic… |
| CVE-2026-53516 | Alta (8.3) | 0.29% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider… |
| CVE-2026-53515 | Alta (7.1) | 0.43% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to… |
| CVE-2026-53514 | Alta (7.7) | 0.20% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and… |
| CVE-2026-53513 | Crítica (9.6) | 0.25% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled… |
| CVE-2026-53512 | Crítica (9.1) | 0.27% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of… |
| CVE-2026-45337 | Alta (7.6) | 0.21% | — | 15 jul 2026 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET… |
| CVE-2026-45364 | Alta (7.3) | 0.50% | — | 28 may 2026 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request by the exact textual IP address it received in… |
| CVE-2025-61928 | Crítica (9.3) | 18% | — | 9 oct 2025 | Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body… |
| CVE-2025-53535 | Baja (2.1) | 0.36% | — | 7 jul 2025 | Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email,… |
| CVE-2025-27143 | Media (6.9) | 0.35% | — | 24 feb 2025 | Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email… |
| CVE-2024-56734 | Alta (7.9) | 0.40% | — | 30 dic 2024 | Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to… |