Skip to content
Threat Feed
Subscribe

Tag

Better-Auth

3 briefs RSS
high advisory

Authorization Bypass Vulnerability in better-auth SCIM

An authorization bypass vulnerability in better-auth SCIM (CVE-2026-67331) allows authenticated users to manage and manipulate SCIM providers belonging to other users due to missing owner-binding checks.

scim cve-2026-67331 authorization-bypass better-auth
1t 1c
critical advisory

Better Auth OAuth Refresh Token Replay via Missing Client Authentication (CVE-2026-53512)

The legacy `oidcProvider` and `mcp` plugins in the `better-auth` library versions prior to 1.6.11 are vulnerable to CVE-2026-53512, an OAuth refresh-token replay attack where the plugins fail to verify the `client_secret` of confidential clients during the `refresh_token` grant, allowing an attacker who obtains a valid `refresh_token` and `client_id` to indefinitely mint new access tokens and impersonate the client for unauthorized resource access.

better-auth oauth authentication-bypass vulnerability web
1t
critical advisory

Better Auth Two-Factor Authentication Bypass Vulnerability

Better Auth versions prior to 1.4.9 have a critical two-factor authentication bypass vulnerability; when session.cookieCache is enabled, the initial sign-in session may be improperly cached, allowing attackers with valid credentials to bypass 2FA.

authentication 2fa bypass better-auth
2r 1t