These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-02T13:16:52.530Z and has not been modified since then. This CVE-2025-71401 vulnerability affects the better-auth package before version 1.4.2, allowing an external request to configure baseURL when it is not otherwise defined. An attacker able to make the very first request to the server after start [truncated]
The CVE-2025-71400 record indicates that better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint. This vulnerability allows authenticated users to delete arbitrary passkeys by ID, potentially leading to unauthorized access or service disruption. The affected product is better-auth passkey, and the vulnerability class is insecure [truncated]
The CVE-2025-71399 vulnerability affects Better Auth versions prior to 1.4.5, which relies on the rou3 router library. This library normalizes paths by removing empty segments, allowing attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. Organizations should be aware of this path normalization bypass vulnerability and take s [truncated]
The better-auth library, used for two-factor authentication, contains a vulnerability in versions before 1.4.9. This vulnerability allows attackers with valid primary credentials to bypass two-factor authentication when session.cookieCache is enabled, due to premature session caching. As a result, attackers can access authenticated routes without completing second-factor verification. The CVE record was p [truncated]
CVE-2026-67336 is a critical vulnerability in better-auth versions before 1.6.11, affecting the oidcProvider and mcp plugins. The vulnerability involves insecure cryptographic defaults, advertising the none algorithm, and accepting plain PKCE by default. This allows attackers to exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used. Affected deplo [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:04.403Z and has not been modified since then. The vulnerability affects better-auth versions before 1.6.2, which fail to validate OAuth state parameters against stored nonces when using cookie-backed state storage without PKCE. This allows attackers to forge state parameters and create auth [truncated]
The CVE record for CVE-2026-67333 was published on 2026-08-01T13:17:04.123Z. The vulnerability affects better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3). It fails to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. This allows an attacker to register an OAuth client with a javascript: redirect_uri. When the autho [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.973Z and has not been modified since then. The vulnerability affects @better-auth/oauth-provider before 1.7.0-beta.4, allowing clients to request tokens for unrelated resources. This can be exploited by attackers to bypass intended authorization boundaries and obtain access tokens for un [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.833Z and has not been modified since then. The vulnerability affects better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4, allowing authenticated users to manage other users' providers due to a binding issue. This issue enables attackers to regenerate SCIM bearer tokens, invalidate l [truncated]
The @better-auth/scim plugin, used for SCIM (System for Cross-domain Identity Management) functionality, contains an authorization bypass vulnerability in versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9. This vulnerability allows an authenticated user to mint a SCIM token whose provider ID collides with an existing provider namespace. As a result, SCIM user routes c [truncated]
The @better-auth/stripe library, used for authentication and authorization in applications, contains a critical vulnerability. This vulnerability, identified as CVE-2026-67329, affects versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10. The issue is an authorization bypass in organization subscription actions, which could allow an authenticated member of multiple organizations to per [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.380Z and has not been modified since then. The vulnerability affects @better-auth/sso versions before 1.6.21, and attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized s [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.227Z and has not been modified since then. The vulnerability affects better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled, allowing account takeover via pre-account hijacking on magic-link [truncated]
The better-auth library, used for authentication in various applications, contains a reflected cross-site scripting (XSS) vulnerability in versions after v0.0.2 and before 1.1.16. This vulnerability is located on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker can exploit this vulnerability by coercing a user into visit [truncated]
The better-auth library versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic, allowing attackers to construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover. This vulnerability affects absolute URLs and wildcard domains. The CVE record was published on 2026-08-01T13:16:56.607Z and has no [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:16:55.510Z and has not been modified since then. The vulnerability affects better-auth versions greater than 1.3.34 and before 1.4.0. The multi-session plugin's /sign-out after-hook trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifyi [truncated]
The Better Auth library for TypeScript, versions 1.6.0 through 1.6.10, contains a vulnerability in its OAuth2 token endpoint. Specifically, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant uses a non-atomic find-then-delete sequence to redeem single-use authorization codes. This allows two concurrent requests to pass the read step and mint independent access tok [truncated]
The CVE-2026-53517 vulnerability affects the Better Auth OAuth Provider, a high-severity issue with a CVSS score of 8.1. The vulnerability is caused by a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families. This issue is fixed in version 1.6.11. [truncated]
CVE-2026-53516 is a HIGH severity vulnerability in Better Auth, an authentication and authorization library for TypeScript. Prior to version 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true. This allows an attacker who pr [truncated]
The CVE record for CVE-2026-53515 was published on 2026-07-15T18:16:47.817Z. The @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role. This issue is fixed in version 1.6.11. Users of Better Auth's @better-auth/sso plugin from [truncated]
The CVE-2026-53513 issue was identified in Better Auth, an authentication and authorization library for TypeScript. The @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints were found to be vulnerable. When skipDiscovery: true is set, these endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs, store them without origin valid [truncated]
CVE-2026-53512 is a critical vulnerability in Better Auth, a TypeScript authentication and authorization library. The vulnerability affects versions prior to 1.6.11 and allows an attacker with a valid refresh token to mint access tokens and rotated refresh tokens without verifying the confidential client's client secret. This issue can have significant operational impact, as it could allow unauthorized ac [truncated]
CVE-2026-45337 is a high-severity authentication bypass vulnerability in Better Auth, a TypeScript library used for authentication and authorization. Versions 1.6.0 to 1.6.10 are affected by this vulnerability, which allows an authenticated attacker to bind a polling device to their account or deny the legitimate flow due to inadequate session validation in the deviceAuthorization plugin. The vulnerabilit [truncated]
A path traversal vulnerability has been identified in better-auth better-icons up to 1.0.5. The vulnerability affects the scan_project_icons/sync_icon component. Manipulation of the icons_file argument can lead to path traversal. Local access is required for an attack. The exploit has been publicly disclosed but vendor response is pending. Users should verify affected versions and monitor for suspicious l [truncated]
Better Auth's HTTP rate limiter prior to versions 1.4.17 and 1.5.0-beta.9 used raw textual IP addresses from x-forwarded-for (or configured IP-bearing headers) as rate-limiting keys without normalization. This allowed IPv6 clients with a /64 allocation to rotate through 2^64 distinct addresses, bypassing per-address rate limits on authentication endpoints including /sign-in/email, /sign-up/email, and /for [truncated]
