• better-auth version 1.4.0 or later, below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
• user.changeEmail.enabled is turned on.
• emailVerification.sendVerificationEmail is configured.
• A new user can register an email address after its previous owner changes to another address.

Affected

better-auth >=1.4.0 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-hwq2-v29r-p69r

• Uses better-auth with both the admin plugin and the phone number plugin enabled.
• A role other than the full admin role holds the user:update permission.
• better-auth version is below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
• Requests to /admin/update-user are not filtered to reject phoneNumber and phoneNumberVerified fields.

Affected

better-auth <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-g95c-wqvr-8c3j

• Uses @better-auth/passkey 1.4.0-beta.16 or later (before 1.7.16 / 1.8.0-beta.5), or the passkey plugin built into better-auth before 1.4.0.
• At least one of: authenticatorSelection.userVerification is set to "required", or the relying party ID also covers origins the project does not control (such as other subdomains).

Affected

better-auth >=1.2.0-beta.18 <1.4.0

Fixed in

1.4.0

ID

GHSA-gv75-j3v8-3crm

• Uses better-auth at a version before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
• Either: secondaryStorage is configured (affected from 0.8.1-beta.5), with sessions revoked in bulk (revoke all sessions or ban user).
• Or: session.cookieCache is enabled together with passkey registration, device authorization, or passwordless two-factor enrollment (affected from 1.6.25).
• An attacker already holds a valid session for the target account.

Affected

better-auth >=0.8.1-beta.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-fvxx-76fc-893x

• Uses the better-auth organization plugin.
• better-auth version is 1.5.5 or later and below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
• A role other than the creator role (owner by default), such as the default admin role, has permission to create invitations.

Affected

better-auth >=1.5.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-c85h-5mrr-mgx4

Source summary

You are affected if you use OAuth sign-in from better-auth 0.4.9 or later and any of these is true: - A provider sends email verified as a string and lets its users keep an unverified address. Amazon Cognito's user info endpoint is one example. - You use genericOAuth() with a provider that has a JWKS endpoint. - You use the Zoom provider with disableSignUp , requireEmailVerification , or overrideUserInfoOnSignIn . You are not affected for providers listed in account.accountLinking.trustedProviders , where linking by email is intended. String claims. Better Auth treated any non-empty email…

Affected

better-auth >=0.4.9 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-9hm7-xhfp-cx58

• Uses the emailOTP() plugin from better-auth version 1.3.7 or later, before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
• For the attempt limit race: any email OTP flow is in use.
• For the email change code issue: better-auth 1.5.0 or later with changeEmail.enabled: true in the emailOTP plugin.
• For the accented address issue: the database uses an accent-insensitive collation (common on MySQL).

Affected

better-auth >=1.3.7 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-2f9c-7xj7-gh55

• Uses the better-auth phone number plugin.
• better-auth version is 0.4.12-beta.7 or later and earlier than 1.7.16 (or 1.8.0-beta.5 on the beta line).
• Public flows such as sign-up allow saving a phoneNumber on an account before it is verified.
• For the shared code problem: better-auth version is 1.2.6-beta.8 or later and no custom verifyOTP function is set.

Affected

better-auth >=0.4.12-beta.7 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5

Fixed in

1.8.0-beta.5 · 1.7.16

ID

GHSA-q747-mqgr-4gh7