@better-auth/oauth-provider
npm3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @better-auth/oauth-providerpage 1 of 1
- CVE-2026-41427MEDIUMCVSS 6.5EG 6.52026-04-24
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients…
- CVE-2026-53517HIGHCVSS 8.1EG 8.1✓ Fixed in 1.6.112026-07-07
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke,…
- CVE-2026-53518HIGHCVSS 8.1EG 7.6✓ Fixed in 1.6.112026-07-07
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code throug…
Check whether @better-auth/oauth-provider is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @better-auth/oauth-provider CVEs against the assets you own.
Start Free Scan →