better-auth: Admin roles with user:update can change another user's phone number.
MediumGHSA-g95c-wqvr-8c3j3 Nov · today
Does it affect you?
0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.Maintainer advisory
Timeline
3 Nov49 minfrom publication to Patchwire
- Published by the maintainer in better-auth/better-auth3 Nov, 22:07 UTC
- Seen by Patchwire +49 min3 Nov, 22:56 UTC
- Not in the GitHub database 49 min later3 Nov, 22:56 UTC
better-auth1.8.0-beta.51.7.16
Versions of better-auth
1.x
safe 1.7.16
AffectedSafe
Packages
Stacks
Related alerts(8)
Same packagesExploitable only if · read by Claude, the source remains the reference
- better-auth version 1.4.0 or later, below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- user.changeEmail.enabled is turned on.
- emailVerification.sendVerificationEmail is configured.
- A new user can register an email address after its previous owner changes to another address.
- Affected
- better-auth >=1.4.0 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-hwq2-v29r-p69r
Exploitable only if · read by Claude, the source remains the reference
- Uses @better-auth/passkey 1.4.0-beta.16 or later (before 1.7.16 / 1.8.0-beta.5), or the passkey plugin built into better-auth before 1.4.0.
- At least one of: authenticatorSelection.userVerification is set to "required", or the relying party ID also covers origins the project does not control (such as other subdomains).
- Affected
- better-auth >=1.2.0-beta.18 <1.4.0
- Fixed in
- 1.4.0
- ID
- GHSA-gv75-j3v8-3crm
Exploitable only if · read by Claude, the source remains the reference
- Uses better-auth at a version before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
- Either: secondaryStorage is configured (affected from 0.8.1-beta.5), with sessions revoked in bulk (revoke all sessions or ban user).
- Or: session.cookieCache is enabled together with passkey registration, device authorization, or passwordless two-factor enrollment (affected from 1.6.25).
- An attacker already holds a valid session for the target account.
- Affected
- better-auth >=0.8.1-beta.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-fvxx-76fc-893x
Exploitable only if · read by Claude, the source remains the reference
- Uses the better-auth organization plugin.
- better-auth version is 1.5.5 or later and below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- A role other than the creator role (owner by default), such as the default admin role, has permission to create invitations.
- Affected
- better-auth >=1.5.5 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-c85h-5mrr-mgx4
Exploitable only if · read by Claude, the source remains the reference
- Uses better-auth version 0.4.9 or later, before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
- Uses OAuth sign-in.
- At least one of: a provider sends email_verified as a string and allows unverified addresses (e.g. Amazon Cognito user info); genericOAuth() is used with a provider that has a JWKS endpoint; or the Zoom provider is used with disableSignUp, requireEmailVerification, or overrideUserInfoOnSignIn.
- The affected provider is not listed in account.accountLinking.trustedProviders.
- Affected
- better-auth >=0.4.9 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-9hm7-xhfp-cx58
Exploitable only if · read by Claude, the source remains the reference
- Database is MySQL or MariaDB.
- advanced.database.generateId is set to "serial".
- Uses the default Kysely adapter or the Drizzle adapter with a connection pool (more than one connection).
- better-auth / adapter package version is below 1.7.16 (or below 1.8.0-beta.5 on the beta line).
- Affected
- better-auth <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-48c2-w96j-mv3m
Exploitable only if · read by Claude, the source remains the reference
- Uses the emailOTP() plugin from better-auth version 1.3.7 or later, before 1.7.16 (or before 1.8.0-beta.5 on the beta line).
- For the attempt limit race: any email OTP flow is in use.
- For the email change code issue: better-auth 1.5.0 or later with changeEmail.enabled: true in the emailOTP plugin.
- For the accented address issue: the database uses an accent-insensitive collation (common on MySQL).
- Affected
- better-auth >=1.3.7 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-2f9c-7xj7-gh55
Exploitable only if · read by Claude, the source remains the reference
- Uses the better-auth phone number plugin.
- better-auth version is 0.4.12-beta.7 or later and earlier than 1.7.16 (or 1.8.0-beta.5 on the beta line).
- Public flows such as sign-up allow saving a phoneNumber on an account before it is verified.
- For the shared code problem: better-auth version is 1.2.6-beta.8 or later and no custom verifyOTP function is set.
- Affected
- better-auth >=0.4.12-beta.7 <1.7.16 · better-auth >=1.8.0-beta.0 <1.8.0-beta.5
- Fixed in
- 1.8.0-beta.5 · 1.7.16
- ID
- GHSA-q747-mqgr-4gh7