@better-auth/expo: Authorization proxy can sign values it did not issue.
Does it affect you?
Not read yetConditions are read in the hourly run that brings the advisory in, or a following one.
You are affected if your server registers the expo() plugin from @better-auth/expo 1.4.0-beta.6 or later. No other setting is needed. The wildcard origin problem below also needs a wildcard entry in trustedOrigins , such as myapp:// or https:// .example.com . Signing values it did not issue. The expo() plugin adds a public endpoint that helps the system browser start a social sign-in. The endpoint signed a value taken from the request with the application secret and returned the signature in a cookie. Better Auth uses the same secret for email verification links and, when enabled, the…
Timeline
3 Nov- Published by the maintainer in better-auth/better-auth3 Nov, 21:37 UTC
- Seen by Patchwire +19 min3 Nov, 21:56 UTC
- Not in the GitHub database 1 h later3 Nov, 22:56 UTC
Versions of better-auth
Packages
Stacks
Related alerts(8)
Same packages- better-auth version 1.4.0 or later, below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- user.changeEmail.enabled is turned on.
- emailVerification.sendVerificationEmail is configured.
- A new user can register an email address after its previous owner changes to another address.
- Affected
- better-auth >=1.4.0 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-hwq2-v29r-p69r
- Uses better-auth with both the admin plugin and the phone number plugin enabled.
- A role other than the full admin role holds the user:update permission.
- better-auth version is below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- Requests to /admin/update-user are not filtered to reject phoneNumber and phoneNumberVerified fields.
- Affected
- better-auth <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-g95c-wqvr-8c3j
- Uses @better-auth/passkey 1.4.0-beta.16 or later (before 1.7.16 / 1.8.0-beta.5), or the passkey plugin built into better-auth before 1.4.0.
- At least one of: authenticatorSelection.userVerification is set to "required", or the relying party ID also covers origins the project does not control (such as other subdomains).
- Affected
- better-auth >=1.2.0-beta.18 <1.4.0
- Fixed in
- 1.4.0
- ID
- GHSA-gv75-j3v8-3crm
- Uses better-auth at a version before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
- Either: secondaryStorage is configured (affected from 0.8.1-beta.5), with sessions revoked in bulk (revoke all sessions or ban user).
- Or: session.cookieCache is enabled together with passkey registration, device authorization, or passwordless two-factor enrollment (affected from 1.6.25).
- An attacker already holds a valid session for the target account.
- Affected
- better-auth >=0.8.1-beta.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-fvxx-76fc-893x
- Uses the better-auth organization plugin.
- better-auth version is 1.5.5 or later and below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- A role other than the creator role (owner by default), such as the default admin role, has permission to create invitations.
- Affected
- better-auth >=1.5.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-c85h-5mrr-mgx4
Source summary
You are affected if you use OAuth sign-in from better-auth 0.4.9 or later and any of these is true: - A provider sends email verified as a string and lets its users keep an unverified address. Amazon Cognito's user info endpoint is one example. - You use genericOAuth() with a provider that has a JWKS endpoint. - You use the Zoom provider with disableSignUp , requireEmailVerification , or overrideUserInfoOnSignIn . You are not affected for providers listed in account.accountLinking.trustedProviders , where linking by email is intended. String claims. Better Auth treated any non-empty email…
- Affected
- better-auth >=0.4.9 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-9hm7-xhfp-cx58
- Database is MySQL or MariaDB.
- advanced.database.generateId is set to "serial".
- Uses the default Kysely adapter or the Drizzle adapter with a connection pool (more than one connection).
- better-auth / adapter package version is below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- Affected
- better-auth <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-48c2-w96j-mv3m
- Uses the emailOTP() plugin from better-auth version 1.3.7 or later, before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
- For the attempt limit race: any email OTP flow is in use.
- For the email change code issue: better-auth 1.5.0 or later with changeEmail.enabled: true in the emailOTP plugin.
- For the accented address issue: the database uses an accent-insensitive collation (common on MySQL).
- Affected
- better-auth >=1.3.7 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-2f9c-7xj7-gh55