• Uses @better-auth/drizzle-adapter (standalone or bundled with better-auth) from 1.6.17 to before 1.7.7 (including 1.7.0 beta.6 through rc.6), or @better-auth/kysely-adapter stable 1.6.x from 1.6.17 onward.
• Rate limiting is enabled.
• Rate-limit records are stored in the database (not in memory or secondary storage).
• The database is PostgreSQL, accessed through one of the affected adapter versions.

Affected

@better-auth/drizzle-adapter >=1.6.17 <1.7.7 · @better-auth/kysely-adapter >=1.6.17 <1.7.0 · better-auth >=1.6.17 <1.7.7

Fixed in

1.7.7 · 1.7.0

ID

GHSA-44jh-23m7-hpcf

• better-auth version is from 1.5.0-beta.12 up to but not including 1.7.7.
• The OAuth Proxy plugin is enabled.
• On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that environment's global Better Auth secret.
• Sign-in state is stored in a cookie (account.storeStateStrategy: "cookie").
• Implicit account linking is enabled (the default; disableImplicitLinking not set to true).

Affected

better-auth >=1.5.0-beta.12 <1.7.7

Fixed in

1.7.7

ID

GHSA-r4xp-prcw-77qf

Source summary

You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain" , or with storeToken: "hashed" and global verification.storeIdentifier: "hashed" (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses account.storeStateStrategy: "database" , the default when a database or secondary storage is configured. Cookie-backed state blocks…

Affected

better-auth >=1.4.0-beta.18 <1.7.7

Fixed in

1.7.7

ID

GHSA-965c-763c-88jm

• better-auth version from 1.3.8-beta.3 up to but not including 1.7.0-rc.3 (includes all 1.6 releases).
• The deviceAuthorization() plugin is enabled.
• An attacker can start a device request: validateClient is not configured, or the attacker can use a valid public client.
• The approval page does not show, from server-checked data, the requesting client and the exact requested permissions before approval.
• Users may approve a code or verification link they did not start and cannot compare it with a device they have.
• The application accepts the session token returned by the device flow (e.g., via the bearer plugin).

Affected

better-auth >=1.3.8-beta.3 <1.7.0-rc.3

Fixed in

1.7.0-rc.3

ID

GHSA-q84f-53jg-9ppm