Security release on Tuesday, November 3, 2026

Better Auth

2 min read Original article ↗

Better Auth v1.7.16 and v1.8.0-beta.5 are now available on npm. They fix the issues described in 12 security advisories, published today on GitHub Security Advisories. Upgrade to the fixed version of your release line.

If you've deployed your app on Vercel, we've applied WAF protections against all reasonably identifiable issues. Regardless, we recommend updating to the latest version of Better Auth.

  • v1.7.x: 1.7.16
  • v1.8.0-beta.x: 1.8.0-beta.5

Packages released separately, such as @better-auth/expo, @better-auth/electron, @better-auth/passkey, @better-auth/stripe and @better-auth/kysely-adapter, ship with the same versions. Update every Better Auth package together.

Critical

Expo

  • Authorization proxy can sign values it did not issue

High

Phone number

  • Phone numbers can be claimed before they are verified

Electron

  • Desktop sign-in can return the server secret and skip two-factor

Medium

Core

  • Email-change links stay valid after the address changes hands
  • OAuth sign-in can treat an unverified provider email as verified
  • MySQL serial IDs can return another request's record (@better-auth/kysely-adapter)
  • Revoked sessions can stay valid with secondary storage or the cookie cache

Email OTP

  • Email OTP attempt limit can be raced and codes are loosely bound to addresses

Admin

  • Admin roles with user:update can change another user's phone number

Organization

  • Organization admins can invite an owner with a padded role name

Stripe

  • Billing actions can target another customer's Stripe account

Low

Passkey

  • Passkey verification does not enforce origin or user verification

Each advisory lists the affected versions and the conditions that decide whether you are affected.

  • Update better-auth and every @better-auth/* package to 1.7.16, or to 1.8.0-beta.5 on the beta line.
  • Read the advisories for the plugins you use. Some fixes add a configuration step, such as listing trusted origins.

Thank you to everyone who reported these issues to us privately. Our ongoing security reviews include work with frontier AI models made available through OSS security programs.

If you believe you have found a vulnerability in Better Auth, please read our security policy first, then open a private report on GitHub or email us at security@better-auth.com.