better-auth
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 14 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 30, 2024 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →better-auth Stale Sessions Persist After User Deletion
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Monitor better-auth in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.