better-auth@1.6.21
The most comprehensive authentication framework for TypeScript.
latest version
1.7.1
latest non vulnerable version
first published
2 years ago
latest version published
2 days ago
licenses detected
- >=1.2.9-beta.9
Direct Vulnerabilities
Known vulnerabilities in the better-auth package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the authentication process. An attacker can gain persistent unauthorized access to user accounts by registering an account with a victim's email address and a chosen password before the victim signs in using passwordless methods. When the victim later signs in via magic-link or email-OTP, the attacker's password remains valid, allowing continued access and potential takeover of the account. This is only exploitable if both the magic-link or email-OTP plugin and open email/password registration are enabled, and an account can be created for an email address before the legitimate owner signs in with the passwordless flow. How to fix Insufficient Verification of Data Authenticity? Upgrade | >=1.1.3 <1.6.22>=1.7.0-beta.0 <1.7.0-beta.10 |