unstale

npm / better-auth

better-auth

What changed in better-auth 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

19 security2 new APIs and options1 performance27 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

better-auth 149 changes

Security 19

  • Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at the specified JWKS path.

    1.7.11release notes

  • Refetches for unknown key IDs are limited to protect servers from repeated requests.

    1.7.10release notes

  • Consent without a reference no longer overwrites or reuses consent for a different reference.

    1.7.10release notes

  • Fixed validation for token and UserInfo requests behind proxies that rewrite request URLs.

    1.7.9release notes

  • Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

    1.6.22security advisory

  • Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

    1.6.13security advisory

  • Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

    1.6.11security advisory

  • Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

    1.6.11security advisory

  • Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

    1.6.11security advisory

  • @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

    1.6.11security advisory

  • Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

    1.6.11security advisory

  • Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

    1.6.11security advisory

  • Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

    1.6.11security advisory

  • Better Auth: OAuth callback accepts mismatched state when cookie-backed state storage is used without PKCE

    1.6.2security advisory

  • Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

    1.6.0security advisory

  • Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

    1.4.17security advisory

  • Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)

    1.4.9security advisory

  • Better Auth affected by external request basePath modification DoS

    1.4.2security advisory

  • Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

    1.4.0security advisory

New APIs and options 2

  • Added optional self-service signing key rotation for private_key_jwt clients.

    1.7.10release notes

  • Added isContinuation so users can complete authorization after selecting an organization.

    1.7.9release notes

Performance 1

  • Reduced installation size while preserving OpenTelemetry instrumentation attributes.

    1.7.11release notes

Fixes and other changes 27

  • Fixed metadata refreshes overwriting concurrent administrator changes to discovered clients.

    1.7.11release notes

  • Plugin init returns with options: undefined now pass type checks under exactOptionalPropertyTypes.

    1.7.11release notes

  • Fixed repeated PostgreSQL migration diffs for int8 columns.

    1.7.11release notes

  • Fixed the OpenAPI schema to match the endpoint's redirect response.

    1.7.11release notes

  • Fixed the OpenAPI schema to match the endpoint's redirect response.

    1.7.11release notes

  • Fixed Expo social account linking with ID tokens when a session cookie is present.

    1.7.11release notes

  • Fixed database-backed rate limiting returning an excessively large X-Retry-After value.

    1.7.11release notes

  • Google One Tap now honors the plugin-level autoSelect setting.

    1.7.10release notes

  • Fixed subpath imports and type resolution for this plugin path.

    1.7.10release notes

  • Fixed imports from this path failing with a not-exported error.

    1.7.10release notes

  • Fixed subpath imports and type resolution for this path.

    1.7.10release notes

  • Google One Tap now honors the plugin-level cancelOnTapOutside setting.

    1.7.10release notes

  • Errors for unknown OAuth client_id values now say client not found.

    1.7.10release notes

  • Device-code clients can refresh access for approved resources omitted from a token poll.

    1.7.10release notes

  • Valid DPoP proofs are no longer rejected for parameterized routes or URLs with trailing slashes.

    1.7.10release notes

  • Requests containing both supported and unsupported grants are no longer rejected.

    1.7.10release notes

  • Google One Tap no longer calls a prompt method unsupported by FedCM or retries skipped prompts.

    1.7.10release notes

  • Google One Tap sign-ins now record google as the last login method.

    1.7.10release notes

  • Google One Tap sign-ins now respect configured Google profile mapping and user info updates.

    1.7.10release notes

  • Native clients with HTTP loopback callbacks are no longer rejected when application type inference is enabled.

    1.7.10release notes

  • Unreachable JWKS endpoints are reported as server errors instead of invalid tokens.

    1.7.10release notes

  • findMany now respects ID sorting, avoiding potentially repeated or skipped paginated results.

    1.7.10release notes

  • Unknown OAuth clients now receive invalid_client instead of invalid_grant.

    1.7.10release notes

  • PKCE verifier errors now return the specified HTTP 400 response and error code.

    1.7.10release notes

  • Attempts to change cached trusted clients now return HTTP 400 instead of HTTP 500.

    1.7.10release notes

  • Unverifiable JWT access tokens no longer cause server errors at userinfo, introspection, or revocation endpoints.

    1.7.10release notes

  • Handlers finish before responses are sent, and failures are logged without interrupting requests.

    1.7.9release notes