Launch Week Day 1: Announcing Security Design Review
Start for Free
npm

better-auth

View on npm registry
13 Total advisories
13 Vulnerabilities
0 Malware

Vulnerabilities

HIGH 7.6
npm

CVE-2026-45337

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
HIGH 7.3
npm

CVE-2026-45364

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
MEDIUM 5.3
npm

GHSA-wxw3-q3m9-c3jr

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
UNKNOWN
npm

GHSA-wmjr-v86c-m9jj

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions
UNKNOWN
npm

GHSA-xg6x-h9c9-2m83

Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)
UNKNOWN
npm

CVE-2024-56734

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
UNKNOWN
npm

CVE-2025-27143

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
HIGH 8.6
npm

GHSA-x732-6j76-qmhm

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
HIGH 8.6
npm

CVE-2025-61928

Better Auth: Unauthenticated API key creation through api-key plugin
HIGH 7.1
npm

GHSA-vp58-j275-797x

Better Auth allows bypassing the trustedOrigins Protection which leads to ATO
UNKNOWN
npm

GHSA-9x4v-xfq5-m8x5

Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)
UNKNOWN
npm

GHSA-569q-mpph-wgww

Better Auth affected by external request basePath modification DoS
UNKNOWN
npm

CVE-2025-53535

Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes