B
Vendor security profile
better-auth
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs27
Critical5
CISA KEV0
Public exploit1
Patch rate%37
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
8
18
0
1
CVE KEV
CVE severity distribution
27toplam CVE
Critical5 (19%)
High16 (59%)
Medium5 (19%)
Low1 (4%)
Patch and exploitation view
%37
Verified patch
%0
CISA KEV
%4
Public exploit
10Patch available
0Partial
0Workaround
0Vendor: no patch
17Unknown
Latest vulnerabilities
8.5
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
B
Patch status unknown
8.6
CVE-2026-80192
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
B
Patch status unknownEPSS %0
9.3
CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS
B
Patch status unknownEPSS %0
7.1
CVE-2025-71400
better-auth passkey before 1.4.0 IDOR via delete-passkey
B
Patch status unknownEPSS %0
8.8
CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3
B
Patch verifiedEPSS %1
9.4
CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
B
Patch status unknownEPSS %0
5.1
CVE-2026-67333
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
B
Patch status unknownEPSS %0
7.1
CVE-2026-67329
@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
B
Patch status unknownEPSS %0
5.1
CVE-2026-67334
better-auth Stale Sessions Persist After User Deletion
B
Patch status unknownEPSS %0
7.1
CVE-2025-71403
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
B
Patch status unknownEPSS %0