better-auth kayıtları
better-auth üreticisine ait 11 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-287 Improper Authentication3
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')2
- CWE-269 Improper Privilege Management1
- CWE-285 Improper Authorization1
- CWE-20 Improper Input Validation1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
11 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
38İzleyin | CVE-2026-53513İstismar yok | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registrationbetter-auth · better-auth\/sso · CWE-20 | Kritik9,6 | — | %0,2 | 15 Tem 2026 |
36İzleyin | CVE-2026-53512İstismar yok | Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsbetter-auth · better auth · CWE-287 | Kritik9,1 | — | %0,3 | 15 Tem 2026 |
33İzleyin | CVE-2026-53516İstismar yok | Better Auth: Account takeover via OAuth auto-link to unverified pre-registered emailbetter-auth · better auth · CWE-287 | Yüksek8,3 | — | %0,3 | 15 Tem 2026 |
32İzleyin | CVE-2026-53517İstismar yok | Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forkingbetter-auth · better-auth\/oauth-provider · CWE-362 | Yüksek8,1 | — | %0,4 | 15 Tem 2026 |
31İzleyin | CVE-2024-56734İstismar yok | Better Auth has an Open Redirect Vulnerability in Verify Email Endpointbetter-auth · better auth · CWE-601 | Yüksek7,9 | — | %0,4 | 30 Ara 2024 |
30İzleyin | CVE-2026-53518İstismar yok | Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemptionbetter-auth · better-auth\/oauth-provider · CWE-362 | Yüksek7,6 | — | %0,4 | 15 Tem 2026 |
30İzleyin | CVE-2026-45337İstismar yok | Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingbetter-auth · better auth · CWE-285 | Yüksek7,6 | — | %0,2 | 15 Tem 2026 |
30İzleyin | CVE-2026-53514İstismar yok | Better Auth: Unauthorized invitation acceptance via unverified email match in organization pluginbetter-auth · better auth · CWE-287 | Yüksek7,7 | — | %0,2 | 15 Tem 2026 |
28İzleyin | CVE-2026-53515İstismar yok | Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/ssobetter-auth · better-auth\/sso · CWE-269 | Yüksek7,1 | — | %0,4 | 15 Tem 2026 |
28İzleyin | CVE-2026-41427İstismar yok | Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clientsbetter-auth · better-auth\/oauth-provider · CWE-863 | Yüksek7,1 | — | %0,4 | 24 Nis 2026 |
27İzleyin | CVE-2025-27143İstismar yok | Beter Auth has an Open Redirect via Scheme-Less Callback Parameterbetter-auth · better auth · CWE-601 | Orta6,9 | — | %0,4 | 24 Şub 2025 |
- CVE-2026-5351338İzleyin
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
KritikCVSS 9,6İstismar yokEPSS %0better-auth · better-auth\/sso15 Tem 2026
- CVE-2026-5351236İzleyin
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
KritikCVSS 9,1İstismar yokEPSS %0better-auth · better auth15 Tem 2026
- CVE-2026-5351633İzleyin
Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
YüksekCVSS 8,3İstismar yokEPSS %0better-auth · better auth15 Tem 2026
- CVE-2026-5351732İzleyin
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
YüksekCVSS 8,1İstismar yokEPSS %0better-auth · better-auth\/oauth-provider15 Tem 2026
- CVE-2024-5673431İzleyin
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
YüksekCVSS 7,9İstismar yokEPSS %0better-auth · better auth30 Ara 2024
- CVE-2026-5351830İzleyin
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
YüksekCVSS 7,6İstismar yokEPSS %0better-auth · better-auth\/oauth-provider15 Tem 2026
- CVE-2026-4533730İzleyin
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
YüksekCVSS 7,6İstismar yokEPSS %0better-auth · better auth15 Tem 2026
- CVE-2026-5351430İzleyin
Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
YüksekCVSS 7,7İstismar yokEPSS %0better-auth · better auth15 Tem 2026
- CVE-2026-5351528İzleyin
Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso
YüksekCVSS 7,1İstismar yokEPSS %0better-auth · better-auth\/sso15 Tem 2026
- CVE-2026-4142728İzleyin
Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients
YüksekCVSS 7,1İstismar yokEPSS %0better-auth · better-auth\/oauth-provider24 Nis 2026
- CVE-2025-2714327İzleyin
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
OrtaCVSS 6,9İstismar yokEPSS %0better-auth · better auth24 Şub 2025