better-auth has 33 CVEs on record. Disclosures have slowed: 10 in the last 90 days after 23 in the 90 before. The busiest recent month was July 2026 with 15. The median CVSS is 8.1 (high), with 6 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-287 (10) and CWE-345 (6). Most affected products: better-auth (15), @better-auth/oauth-provider (3), sso (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 10 prev 23
Weakness classes
Products
- better-auth 15
- @better-auth/oauth-provider 3
- sso 3
- @better-auth/scim 2
- @better-auth/sso 2
- scim 2
Worst active — by depth score
CVE-2026-67331High· 8.3better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers58CVE-2026-67330Critical· 9.9@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass55GHSA-rjg6-39jm-rgg4Critical· 9.9@better-auth/scim: account takeover and stale access via SCIM provider-id collision54CVE-2026-53513Critical· 9.6@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints53CVE-2026-114607Critical· 9.1better-auth: OAuth state can be used as a Magic Link to sign in as another user50
better-auth vulnerabilities
CVEs affecting better-auth, newest first. Open any entry for full detail, references, and exploit status.
33 CVEsRSS
GHSA-2vg6-77g8-24mpLow· 3.8Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
GHSA-j8v8-g9cx-5qf4High· 8.3@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
CVE-2026-53512Critical· 9.1Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins