These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The better-auth library versions 1.3.8-beta.3 before 1.7.0-rc.3 contain a UI misrepresentation vulnerability in the deviceAuthorization plugin. This vulnerability allows attackers to trick signed-in users into approving a device request, potentially leading to phishing attacks. The vulnerability is caused by the deviceAuthorization plugin omitting the requesting client_id and scope in the GET /device requ [truncated]
The @better-auth/sso library contains two domain-ownership flaws that can lead to authentication bypass attacks. When domain verification is disabled, an authenticated organization owner/administrator can register an SSO provider for an arbitrary domain, allowing users with matching email domains to be added to the attacker's organization. When domain verification is enabled, a race condition between the [truncated]
CVE-2025-71401 better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). This issue highlights the importance of validating and sanitizing external requests to prevent such a [truncated]
CVE-2025-71400 is a high-severity vulnerability in better-auth passkey versions before 1.4.0. An authenticated user can delete arbitrary passkeys by ID due to an insecure direct object reference vulnerability in the passkey deletion endpoint. This vulnerability allows attackers with valid sessions to submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' [truncated]
CVE-2025-71399 debrief based on the supplied source corpus. Better Auth relies on better-call, which uses the rou3 router library. The rou3 library normalizes paths by removing empty segments, allowing attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. This issue affects Better Auth versions prior to 1.4.5, which bundles th [truncated]
The better-auth library, used for two-factor authentication, contains a vulnerability in versions before 1.4.9. This vulnerability allows attackers with valid primary credentials to bypass two-factor authentication when session.cookieCache is enabled, due to premature session caching. As a result, attackers can access authenticated routes without completing second-factor verification. The CVE record was p [truncated]
CVE-2026-67336 is a critical vulnerability in better-auth versions before 1.6.11, affecting the oidcProvider and mcp plugins. The vulnerability involves insecure cryptographic defaults, advertising the none algorithm, and accepting plain PKCE by default. This allows attackers to exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used. Affected deplo [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:04.403Z and has not been modified since then. The vulnerability affects better-auth versions before 1.6.2, which fail to validate OAuth state parameters against stored nonces when using cookie-backed state storage without PKCE. This allows attackers to forge state parameters and create auth [truncated]
The better-auth library before version 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fails to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. This allows an attacker to register an OAuth client with a javascript: redirect_uri, which can lead to the execution of JavaScript in the authorization-server origin, potentially exposing [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.227Z and has not been modified since then. The vulnerability affects better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled, allowing account takeover via pre-account hijacking on magic-link [truncated]
A reflected cross-site scripting (XSS) vulnerability exists in better-auth versions after v0.0.2 and before 1.1.16 on the /api/auth/error page. The issue is fixed in version 1.1.16. This vulnerability allows for arbitrary JavaScript execution in the context of a user's browser if an attacker can coerce the user into visiting a specially-crafted URL. Defenders should assess exposure and apply the patch. Th [truncated]
CVE-2025-71403 better-auth Open Redirect via trustedOrigins Bypass. The vulnerability in better-auth versions before 1.1.20 allows attackers to construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover. Defenders responsible for better-auth deployments should assess exposure and prioritize verification of versions before 1. [truncated]
An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens in better-auth versions greater than 1.3.34 and before 1.4.0 due to a vulnerability in the multi-session plugin's /sign-out after-hook. This occurs because the plugin trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature.
The @better-auth/stripe library, used for authentication and authorization in applications, contains a critical vulnerability. This vulnerability, identified as CVE-2026-67329, affects versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10. The issue is an authorization bypass in organization subscription actions, which could allow an authenticated member of multiple organizations to per [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.973Z and has not been modified since then. The vulnerability affects @better-auth/oauth-provider before 1.7.0-beta.4, allowing clients to request tokens for unrelated resources. This can be exploited by attackers to bypass intended authorization boundaries and obtain access tokens for un [truncated]
CVE-2026-67328 @better-auth/sso Authentication Bypass Vulnerability. The vulnerability allows attackers to sign in as arbitrary users by exploiting domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints. Defenders should assess exposure and prioritize upgrading to version 1.6.21 or later to prevent authentication bypass attacks. Th [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:03.833Z and has not been modified since then. The vulnerability affects better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4, allowing authenticated users to manage other users' providers due to a binding issue. This issue enables attackers to regenerate SCIM bearer tokens, invalidate l [truncated]
The @better-auth/scim plugin, used for SCIM (System for Cross-domain Identity Management) functionality, contains an authorization bypass vulnerability in versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9. This vulnerability allows an authenticated user to mint a SCIM token whose provider ID collides with an existing provider namespace. As a result, SCIM user routes c [truncated]
The Better Auth library for TypeScript, versions 1.6.0 through 1.6.10, contains a vulnerability in its OAuth2 token endpoint. Specifically, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant uses a non-atomic find-then-delete sequence to redeem single-use authorization codes. This allows two concurrent requests to pass the read step and mint independent access tok [truncated]
The CVE-2026-53517 vulnerability affects the Better Auth OAuth Provider, a high-severity issue with a CVSS score of 8.1. The vulnerability is caused by a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families. This issue is fixed in version 1.6.11. [truncated]
CVE-2026-53516 is a HIGH severity vulnerability in Better Auth, an authentication and authorization library for TypeScript. Prior to version 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true. This allows an attacker who pr [truncated]
The CVE record for CVE-2026-53515 was published on 2026-07-15T18:16:47.817Z. The @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role. This issue is fixed in version 1.6.11. Users of Better Auth's @better-auth/sso plugin from [truncated]
The CVE-2026-53513 issue was identified in Better Auth, an authentication and authorization library for TypeScript. The @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints were found to be vulnerable. When skipDiscovery: true is set, these endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs, store them without origin valid [truncated]
CVE-2026-53512 is a critical vulnerability in Better Auth, a TypeScript authentication and authorization library. The vulnerability affects versions prior to 1.6.11 and allows an attacker with a valid refresh token to mint access tokens and rotated refresh tokens without verifying the confidential client's client secret. This issue can have significant operational impact, as it could allow unauthorized ac [truncated]
CVE-2026-45337 is a high-severity authentication bypass vulnerability in Better Auth, a TypeScript library used for authentication and authorization. Versions 1.6.0 to 1.6.10 are affected by this vulnerability, which allows an authenticated attacker to bind a polling device to their account or deny the legitimate flow due to inadequate session validation in the deviceAuthorization plugin. The vulnerabilit [truncated]
A path traversal vulnerability has been identified in better-auth better-icons up to 1.0.5. The vulnerability affects the scan_project_icons/sync_icon component. Manipulation of the icons_file argument can lead to path traversal. Local access is required for an attack. The exploit has been publicly disclosed but vendor response is pending. Users should verify affected versions and monitor for suspicious l [truncated]
Better Auth's HTTP rate limiter prior to versions 1.4.17 and 1.5.0-beta.9 used raw textual IP addresses from x-forwarded-for (or configured IP-bearing headers) as rate-limiting keys without normalization. This allowed IPv6 clients with a /64 allocation to rotate through 2^64 distinct addresses, bypassing per-address rate limits on authentication endpoints including /sign-in/email, /sign-up/email, and /for [truncated]
