https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-53518.htmlhttps://patchthecve.com/cve/CVE-2026-53518.htmlTue, 21 Jul 2026 16:03:12 +0000HIGH 8.1: Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurhttps://patchthecve.com/cve/CVE-2026-53517.htmlhttps://patchthecve.com/cve/CVE-2026-53517.htmlTue, 21 Jul 2026 16:00:22 +0000HIGH 8.1: Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing conhttps://patchthecve.com/cve/CVE-2026-53516.htmlhttps://patchthecve.com/cve/CVE-2026-53516.htmlTue, 21 Jul 2026 14:14:22 +0000HIGH 8.3: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified fihttps://patchthecve.com/cve/CVE-2026-53515.htmlhttps://patchthecve.com/cve/CVE-2026-53515.htmlTue, 21 Jul 2026 15:38:36 +0000HIGH 7.1: Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and https://patchthecve.com/cve/CVE-2026-53514.htmlhttps://patchthecve.com/cve/CVE-2026-53514.htmlTue, 21 Jul 2026 13:41:03 +0000HIGH 7.7: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitathttps://patchthecve.com/cve/CVE-2026-53513.htmlhttps://patchthecve.com/cve/CVE-2026-53513.htmlTue, 21 Jul 2026 15:39:52 +0000CRITICAL 9.6: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true ihttps://patchthecve.com/cve/CVE-2026-53512.htmlhttps://patchthecve.com/cve/CVE-2026-53512.htmlTue, 21 Jul 2026 13:33:47 +0000CRITICAL 9.1: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidehttps://patchthecve.com/cve/CVE-2026-45337.htmlhttps://patchthecve.com/cve/CVE-2026-45337.htmlTue, 21 Jul 2026 04:21:25 +0000HIGH 7.6: Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-