npm

better-auth

23 Total advisories

23 Vulnerabilities

0 Malware

Dependency scanning

Check whether better-auth is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

better-auth

Vulnerabilities

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

Duplicate Advisory: better-auth has an external request basePath modification DoS

Better Auth affected by external request basePath modification DoS

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)

Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Better Auth allows bypassing the trustedOrigins Protection which leads to ATO

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Better Auth: Unauthenticated API key creation through api-key plugin

Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes

Browse more npm advisories

Start Securing