npm - OSV

GHSA-qq9h-g4jm-xgf3

npm/better-auth

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in 24 Jul

Fix available
Severity - 8.3 (High)

GHSA-2vg6-77g8-24mp

npm/@better-auth/scim
npm/better-auth

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows 07 Jul

Fix available
Severity - 3.8 (Low)

GHSA-7w99-5wm4-3g79

npm/@better-auth/oauth-provider
npm/better-auth

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive 07 Jul

Fix available
Severity - 7.6 (High)

GHSA-392p-2q2v-4372

npm/@better-auth/oauth-provider
npm/better-auth

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption 07 Jul

Fix available
Severity - 7.6 (High)

GHSA-9h47-pqcx-hjr4

npm/better-auth

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default 07 Jul

Fix available
Severity - 8.7 (High)

GHSA-86j7-9j95-vpqj

npm/better-auth

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp 07 Jul

Fix available
Severity - 7.7 (High)

GHSA-g38m-r43w-p2q7

npm/better-auth

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email 07 Jul

Fix available
Severity - 8.3 (High)

GHSA-fmh4-wcc4-5jm3

npm/better-auth

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin 07 Jul

Fix available
Severity - 7.7 (High)

GHSA-pw9m-5jxm-xr6h

npm/better-auth

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins 07 Jul

Fix available
Severity - 9.1 (Critical)

MAL-2026-6000

npm/@mastra/auth-better-auth

Malicious code in @mastra/auth-better-auth (npm) 17 Jun

No fix available

GHSA-cq3f-vc6p-68fh

npm/better-auth

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending 04 Jun

Fix available
Severity - 7.6 (High)

GHSA-p6v2-xcpg-h6xw

npm/better-auth

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation 15 May

Fix available
Severity - 7.3 (High)

GHSA-wxw3-q3m9-c3jr

npm/better-auth

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE 15 May

Fix available
Severity - 5.3 (Medium)

GHSA-xg6x-h9c9-2m83

npm/better-auth

Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) 03 Apr

Fix available
Severity - 9.1 (Critical)

GHSA-x732-6j76-qmhm

npm/better-auth

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits 16 Dec 2025

Fix available
Severity - 8.6 (High)

GHSA-569q-mpph-wgww

npm/better-auth

Better Auth affected by external request basePath modification DoS 01 Dec 2025

Fix available
Severity - 8.9 (High)

Vulnerabilities