# What changed in @better-auth/core

> 10 changes in @better-auth/core 1 from its official release notes, upgrade guides and advisories: 3 breaking, 4 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@better-auth/core/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @better-auth/core 1

### Breaking changes

- Custom Paybin issuers must expose RS256 signing keys at the issuer's JWKS endpoint. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1711)
- A key-set fetch taking longer than 5 seconds now fails with a JWKSTimeout error instead of waiting indefinitely. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1710)
- Unreachable key sets now throw errors instead of making tokens appear invalid; with remoteVerify configured, failures no longer fall back to remote introspection. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1710)

### Security

- Twitch and Paybin sign-in verify ID token signatures and identity claims before mapping profiles, with 30 seconds of clock tolerance. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1711)
- @better-auth/scim: account takeover and stale access via SCIM provider-id collision (1.6.22) — [security advisory](https://github.com/advisories/GHSA-RJG6-39JM-RGG4)
- @better-auth/stripe: cross-organization billing tampering in organization subscription actions (1.6.21) — [security advisory](https://github.com/advisories/GHSA-H3RM-78G3-J7CP)
- OAuth 2.1 Provider: Unprivileged users can register OAuth clients (1.6.5) — [security advisory](https://github.com/advisories/GHSA-XR8F-H2GW-9XH6)

### Performance

- The semantic conventions production dependency was removed, reducing installation size while preserving instrumentation attribute keys. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1711)
- An unknown kid triggers at most one key-set refetch every 30 seconds per server process, and concurrent verifications share that fetch, limiting requests caused by made-up key IDs. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1710)

### Fixes and other changes

- Plugins whose init returns options: undefined now typecheck when exactOptionalPropertyTypes is enabled. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/blob/52ab801cc6550104199bcf70a3f83005e15eb804/packages/core/CHANGELOG.md#1711)