better-auth@1.8.0-beta.4

The most comprehensive authentication framework for TypeScript.

latest version

1.7.18

latest non vulnerable version

1.8.0-beta.6

first published

2 years ago

latest version published

2 days ago

licenses detected

MIT
>=1.2.9-beta.9

View better-auth package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the better-auth package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Origin Validation Error better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Origin Validation Error via the `expo()` plugin's public authorization-proxy endpoint, which signs a caller-supplied `state` value with the application secret without verifying that the server had previously issued that value. Because the same HMAC-SHA256 secret is used for email verification links and the session cookie cache, an attacker can forge an email-change token or a session cookie cache value that Better Auth accepts as legitimate. This allows an unauthenticated attacker who knows a target user's email address to take over the account and change its email address, and - when the session cookie cache is enabled - an attacker who knows a user's ID to act as that user. Note: The session cookie cache attack vector is only exploitable when the session cookie cache feature is explicitly enabled. How to fix Origin Validation Error? Upgrade `better-auth` to version 1.7.16, 1.8.0-beta.5 or higher.	<1.7.16>=1.8.0-beta.0 <1.8.0-beta.5

Origin Validation Error

better-auth is a The most comprehensive authentication library for TypeScript.

Affected versions of this package are vulnerable to Origin Validation Error via the expo() plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret without verifying that the server had previously issued that value. Because the same HMAC-SHA256 secret is used for email verification links and the session cookie cache, an attacker can forge an email-change token or a session cookie cache value that Better Auth accepts as legitimate. This allows an unauthenticated attacker who knows a target user's email address to take over the account and change its email address, and - when the session cookie cache is enabled - an attacker who knows a user's ID to act as that user.

Note: The session cookie cache attack vector is only exploitable when the session cookie cache feature is explicitly enabled.

How to fix Origin Validation Error?

Upgrade better-auth to version 1.7.16, 1.8.0-beta.5 or higher.

<1.7.16>=1.8.0-beta.0 <1.8.0-beta.5

Go back to all versions of this package