better auth/security

25 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

July 2026 security update advisory releases

Four security advisories were fixed in July 2026 across @auth/core, next-auth v4, and next-auth v5. Users must update to: next-auth v5 (beta channel) to 5.0.0-beta.32, next-auth v4 (latest channel) to 4.24.15, and @auth/core to 0.41.3. The @auth/* framework and adapter packages were republished on their own version lines to include the fixed core.

GHSA-7rqj-j65f-68wh advisory details

Email validated before Unicode normalization (homoglyph @ bypass) - High severity. Fixed in @auth/core@0.41.3, next-auth@4.24.15, next-auth@5.0.0-beta.32.

GHSA-xmf8-cvqr-rfgj advisory details

getToken throws on malformed authorization headers - High severity. Fixed in @auth/core@0.41.3, next-auth@4.24.15, next-auth@5.0.0-beta.32.

GHSA-x445-f3h2-j279 advisory details

OAuth check cookies not bound to their issuing provider - Medium severity. Fixed in @auth/core@0.41.3, next-auth@4.24.15, next-auth@5.0.0-beta.32.

GHSA-8fpg-xm3f-6cx3 advisory details

Auth checks fail open on provider configuration errors - Low severity. Fixed in next-auth@5.0.0-beta.32 only (affects v5 middleware only).

Better Auth stable release version as of June 2026

Better Auth 1.6.14 is the current stable release. Stable projects should update to the latest 1.6.x version.

Better Auth scoped packages requiring updates

Some advisories affect scoped packages such as @better-auth/sso, @better-auth/scim, or @better-auth/oauth-provider. Update any Better Auth packages installed directly, not only the top-level better-auth package.

Core Better Auth security advisory GHSA-g38m-r43w-p2q7

Advisory GHSA-g38m-r43w-p2q7 addresses OAuth account linking ownership with high severity. Fixed in better-auth@1.6.11.

Core Better Auth security advisory GHSA-2vg6-77g8-24mp

Advisory GHSA-2vg6-77g8-24mp addresses session cleanup after user deletion with low severity. Fixed in better-auth@1.6.11 and @better-auth/scim@1.6.11.

Organization security advisory GHSA-fmh4-wcc4-5jm3

Advisory GHSA-fmh4-wcc4-5jm3 addresses organization invitation ownership with high severity. Fixed in better-auth@1.6.11, with compatibility follow-up in better-auth@1.6.14.

Device Authorization security advisory GHSA-cq3f-vc6p-68fh (CVE-2026-45337)

Advisory GHSA-cq3f-vc6p-68fh (CVE-2026-45337) addresses device-flow owner binding with high severity. Fixed in better-auth@1.6.11.

OAuth Provider security advisory GHSA-xr8f-h2gw-9xh6 (CVE-2026-41427)

Advisory GHSA-xr8f-h2gw-9xh6 (CVE-2026-41427) addresses OAuth client privilege checks with high severity. Fixed in @better-auth/oauth-provider@1.6.5.

OAuth Provider security advisory GHSA-7w99-5wm4-3g79

Advisory GHSA-7w99-5wm4-3g79 addresses OAuth authorization-code redemption with high severity. Fixed in better-auth@1.6.11 and @better-auth/oauth-provider@1.6.11.

OAuth Provider security advisory GHSA-392p-2q2v-4372

Advisory GHSA-392p-2q2v-4372 addresses OAuth refresh-token rotation with high severity. Fixed in @better-auth/oauth-provider@1.6.11.

OAuth Provider security advisory GHSA-p2fr-6hmx-4528

Advisory GHSA-p2fr-6hmx-4528 addresses OAuth resource indicators with medium severity. Fixed in @better-auth/oauth-provider@1.7.0-beta.4.

SCIM security advisory GHSA-j8v8-g9cx-5qf4

Advisory GHSA-j8v8-g9cx-5qf4 addresses SCIM provider ownership with high severity. Fixed in @better-auth/scim@1.7.0-beta.4.

SSO security advisory GHSA-5rr4-8452-hf4v

Advisory GHSA-5rr4-8452-hf4v addresses SSO provider registration URL validation with critical severity. Fixed in @better-auth/sso@1.6.11.

SSO security advisory GHSA-gv74-j8m3-fg5f

Advisory GHSA-gv74-j8m3-fg5f addresses SSO provider registration authorization with high severity. Fixed in @better-auth/sso@1.6.11.

Authorization-server integration security advisory GHSA-pw9m-5jxm-xr6h

Advisory GHSA-pw9m-5jxm-xr6h addresses OIDC and MCP refresh-token handling with critical severity. Fixed in better-auth@1.6.11.

Authorization-server integration security advisory GHSA-86j7-9j95-vpqj

Advisory GHSA-86j7-9j95-vpqj addresses OIDC and MCP redirect URI validation with high severity. Fixed in better-auth@1.6.13 and better-auth@1.7.0-beta.4.

Authorization-server integration security advisory GHSA-9h47-pqcx-hjr4

Advisory GHSA-9h47-pqcx-hjr4 addresses OIDC and MCP protocol defaults with high severity. Fixed in better-auth@1.6.11.

Better Auth stable release update guidance

Update stable projects to better-auth@latest, which as of the June 2026 security update is 1.6.14. Update next channel projects to the version named in the advisory, with several current advisories pointing to 1.7.0-beta.4. Update scoped Better Auth packages too, as several advisories affect packages such as @better-auth/sso, @better-auth/scim, and @better-auth/oauth-provider.

How to stay current with Better Auth security updates

Update stable projects to better-auth@latest. Update next channel projects to the version named in the advisory. Update scoped Better Auth packages too. Watch the repository releases page. Watch the Security Advisories tab on GitHub. Run audit tools such as GitHub Dependabot and npm audit against your lockfile.

Better Auth security fix strategy for stable releases

When a fix can preserve public types, defaults, and request or response shapes, it goes into the following 1.6.x release. Some issues require a stronger default or a different API contract. In those cases, a compatible stable fix can be shipped with documented stricter configuration, the complete fix can be shipped through the next package channel when stable compatibility would hide the risk, or a workaround can be published in the advisory when the stable line cannot safely take the breaking change.

Better Auth security review workstream

Better Auth has started a dedicated security-review workstream covering report triage, focused code review, automated and manual scanning, variant analysis, patch review, release coordination, and advisory publication.

Give your agent this brain