GHSA-wxw3-q3m9-c3jr
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 15, 2026
CISA due date
—
The record
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | better-auth | 0 | 1.6.2 |
Related vulnerabilities
- GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while… Also affects better-auth
- CVE-2026-45364 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth
- GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix… Also affects better-auth
- GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching… Also affects better-auth
- GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass… Also affects better-auth
- GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS Also affects better-auth
- GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary… Also affects better-auth
- CVE-2025-61928 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth