Vulnerabilities
Last updated 1 hour ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
@better-auth/scim
|
@better-auth/scim: account takeover and stale access via SCIM provider-id collision | Critical 9.9 | 2 months ago | 4 hours ago |
|
better-auth
|
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows | Low Risk 3.8 | 3 months ago | 1 month ago |
|
@better-auth/scim
|
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows | Low Risk 3.8 | 3 months ago | 1 month ago |
|
@better-auth/scim
|
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers | High Risk 8.3 | 3 months ago | 1 month ago |
|
@better-auth/oauth-provider
|
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators | Medium Risk 6.4 | 3 months ago | 1 month ago |
|
better-auth
|
Better Auth affected by external request basePath modification DoS | High Risk 8.0 | 10 months ago | 1 month ago |
|
@better-auth/passkey
|
Better Auth Passkey Plugin allows passkey deletion through IDOR | High Risk 7.1 | 10 months ago | 2 months ago |
|
better-auth
|
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits | High Risk 8.6 | 10 months ago | 2 months ago |
|
better-auth
|
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) | Critical 9.5 | 6 months ago | 2 months ago |
|
better-auth
|
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp | High Risk 7.7 | 3 months ago | 2 months ago |
|
better-auth
|
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default | High Risk 8.7 | 3 months ago | 2 months ago |
|
better-auth
|
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) | Medium Risk 6.0 | 1 year ago | 2 months ago |
|
better-auth
|
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in | High Risk 8.3 | 2 months ago | 2 months ago |
|
better-auth
|
Better Auth allows bypassing the trustedOrigins Protection which leads to ATO | High Risk 7.1 | 1 year ago | 2 months ago |
|
better-auth
|
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions | Low Risk 3.0 | 10 months ago | 2 months ago |
|
better-auth
|
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE | Medium Risk 5.3 | 5 months ago | 2 months ago |
|
@better-auth/stripe
|
@better-auth/stripe: cross-organization billing tampering in organization subscription actions | High Risk 7.1 | 2 months ago | 2 months ago |
|
@better-auth/sso
|
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role | High Risk 7.1 | 3 months ago | 3 months ago |
|
better-auth
|
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption | High Risk 8.1 | 3 months ago | 3 months ago |
|
@better-auth/oauth-provider
|
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption | High Risk 8.1 | 3 months ago | 3 months ago |
|
@better-auth/sso
|
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints | Critical 9.6 | 3 months ago | 3 months ago |
|
better-auth
|
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive | High Risk 8.1 | 3 months ago | 3 months ago |
|
@better-auth/oauth-provider
|
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive | High Risk 8.1 | 3 months ago | 3 months ago |
|
better-auth
|
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins | Critical 9.1 | 3 months ago | 3 months ago |
|
better-auth
|
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin | High Risk 7.7 | 3 months ago | 3 months ago |
|
better-auth
|
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email | High Risk 8.3 | 3 months ago | 3 months ago |
|
@mastra/auth-better-auth
|
Malicious code in @mastra/auth-better-auth (npm) | Unknown | 4 months ago | 3 months ago |
|
better-auth
|
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending | High Risk 7.6 | 4 months ago | 4 months ago |
|
better-auth
|
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation | High Risk 7.3 | 5 months ago | 4 months ago |
|
@better-auth/oauth-provider
|
OAuth 2.1 Provider: Unprivileged users can register OAuth clients | High Risk 8.0 | 6 months ago | 5 months ago |
|
better-auth
|
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint | High Risk 8.0 | 1 year ago | 8 months ago |
|
better-auth
|
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter | Medium Risk 6.0 | 1 year ago | 8 months ago |
|
better-auth
|
Better Auth: Unauthenticated API key creation through api-key plugin | High Risk 8.6 | 1 year ago | 10 months ago |
|
@silgi/better-auth
|
Malicious code in @silgi/better-auth (npm) | Unknown | 10 months ago | 10 months ago |
|
better-auth-nuxt
|
Malicious code in better-auth-nuxt (npm) | Unknown | 10 months ago | 10 months ago |
|
better-auth
|
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes | Low Risk 3.0 | 1 year ago | 1 year ago |
Page 1