[ Vendor · 6 CVEs ]
better-auth
CVEs affecting better-auth published in the last 30 days, plus any better-auth CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114607 | 22 Oct 2026 | CVSS 9.1 | better-authBetter Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with… | |
| CVE-2026-110861 | 14 Oct 2026 | CVSS 3.7 | better-auth drizzle-adapterBetter Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain… | |
| CVE-2026-110862 | 14 Oct 2026 | CVSS 9.1 | better-authBetter Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other… | |
| CVE-2026-110863 | 14 Oct 2026 | CVSS 8.1 | better-auth ssoBetter Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in… | |
| CVE-2026-110864 | 14 Oct 2026 | CVSS 7.4 | better-authBetter Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated… | |
| CVE-2026-109346 | 12 Oct 2026 | CVSS 8.1 | better-authbetter-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device… |