better-auth

## Am I affected? You are affected if you use `@better-auth/drizzle-adapter` from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or `@better-auth/kysely-adapter` 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must be true: - Rate limiting is enabled. - Rate-limit records are stored in the database. - The database is PostgreSQL, used through one of the adapter versions above. You are not affected if you store rate-limit records in memory (the default) or in secondary storage. ## Summary Database-ba

CVE: CVE-2026-110861

## Am I affected? You may be affected if you use `better-auth` from `1.4.0-beta.18` through versions before `1.7.7` with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if **all** of these are true: - Magic Link is enabled with default `storeToken: "plain"`, or with `storeToken: "hashed"` and global `verification.storeIdentifier: "hashed"` (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses `account.storeStateStrategy: "database"`, the default when a database or secondary storage is config

CVE: CVE-2026-110862

## Am I affected? You may be affected if you use `better-auth` from `1.3.8-beta.3` up to, but not including, `1.7.0-rc.3`, and you enable the `deviceAuthorization()` plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device request: `validateClient` is not configured, or the attacker can use a valid public client. - Before allowing approval, your approval page does not show, from server-checked data, which client is asking and the exact permissions it requests. - Users may approve a code or complete verification link

CVE: CVE-2026-109346

## Am I affected? You may be affected if you use `better-auth` from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated `secret`, or its `secret` equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie (`account.storeStateStrategy: "cookie"`). With a database or secondary storage, this is only the case if you chose it explicitly. - Implicit account linking is on (the default). You are not affected by this p

CVE: CVE-2026-110864

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-569q-mpph-wgww. This link is maintained to preserve external references. ## Original Description better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed

### Am I affected You are affected if all of the following hold: - You run a `better-auth` version below 1.6.22, or a `1.7.0-beta` below `1.7.0-beta.10`. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist at an address before its owner first signs in with the passwordless flow. ### Summary An attacker can keep password access to a victim's account after the victim starts using it. The attack runs in three steps. First, with open registration, the attacker signs up using the victim's email a

CVE: CVE-2026-67327

### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `betterAuth(...)` (Redis, KV, or any external session cache). - `session.storeSessionInDatabase` is left unset or set to `false` (the default). - Their application's deployment uses one or more of: - The `admin` plugin and calls `auth.api.removeUser(...)` or `authClient.admin.removeUser(...)`. - The `anonymous` plugin and exposes `/delete-anonymous-user` or relies on the after-link hook to clean up the anonymous user. - The `@better-auth/scim` plugin and exposes `DELETE /scim/

CVE: CVE-2026-67334

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>= 1.6.0, < 1.6.11`, or uses the embedded plugin in `better-auth >= 1.4.8-beta.7, < 1.6.0`. - At least one OAuth client served by their application's authorization server requests the `offline_access` scope, so refresh tokens are minted. - Concurrent redemption of the same refresh token is reachable: an SPA shares one refresh token across browser tabs without a mutex, a mobile client retries after a transient failure, an attacker who has stolen a refr

CVE: CVE-2026-53517

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>= 1.6.0, < 1.6.11`, or uses the embedded plugin in `better-auth >= 1.4.8-beta.7, < 1.6.0`, or enables the legacy `oidc-provider` or `mcp` plugins from `better-auth/plugins`. - Their application exposes `/api/auth/oauth2/token` (or the legacy plugins' `/oauth2/token` and `/mcp/token`) as a token endpoint to OAuth/OIDC clients, including internal MCP clients (Claude Desktop, custom MCP tool callers, AI agents). - Their application has not implemented a

CVE: CVE-2026-53518

### Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the `oidc-provider` plugin or the `mcp` plugin from `better-auth/plugins`. The `mcp` plugin wraps the same provider and carries the same defect. Both are on the migration path to `@better-auth/oauth-provider`, which is not affected. - Their application `better-auth` version is `1.6.12` or earlier on the stable line, or any `1.7.0-beta` build on the pre-release line. Both release lines carry the same defect. - Their application consent page is a client component that reads

CVE: CVE-2026-67333