better-auth (npm) has 26 known vulnerabilities, the worst rated CRITICAL. Upgrade to 1.7.7 or later to clear all of them. No malicious-package signal is recorded.
You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in.
CyberXYZ does not call a package safe in absolute terms. It records 26 known vulnerabilities for better-auth (npm), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does better-auth have known vulnerabilities?
Yes. CyberXYZ records 26 known vulnerabilities for better-auth (npm), the worst rated CRITICAL. These include GHSA-965c-763c-88jm, GHSA-pw9m-5jxm-xr6h, GHSA-xg6x-h9c9-2m83, GHSA-q84f-53jg-9ppm, GHSA-r4xp-prcw-77qf.
Which version of better-auth should I use?
1.7.7 or later clears every advisory recorded for better-auth (npm). Check the release you pick before installing it.
How do I check better-auth before installing?
Search better-auth in CyberXYZ Check at https://cyberxyz.io/check?q=better-auth. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 05:21 UTC. The most recent advisory here was published 2026-10-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.