# What changed in better-auth

> 49 changes in better-auth 1 from its official release notes, upgrade guides and advisories: 19 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/better-auth/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## better-auth 1

### Security

- Fixed ID token signature and claim validation for Twitch and Paybin sign-in. Custom Paybin issuers must publish RS256 signing keys at the specified JWKS path. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Refetches for unknown key IDs are limited to protect servers from repeated requests. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Consent without a reference no longer overwrites or reuses consent for a different reference. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Fixed validation for token and UserInfo requests behind proxies that rewrite request URLs. (1.7.9) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.9)
- Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in (1.6.22) — [security advisory](https://github.com/advisories/GHSA-QQ9H-G4JM-XGF3)
- Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp (1.6.13) — [security advisory](https://github.com/advisories/GHSA-86J7-9J95-VPQJ)
- Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending (1.6.11) — [security advisory](https://github.com/advisories/GHSA-CQ3F-VC6P-68FH)
- Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email (1.6.11) — [security advisory](https://github.com/advisories/GHSA-G38M-R43W-P2Q7)
- Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default (1.6.11) — [security advisory](https://github.com/advisories/GHSA-9H47-PQCX-HJR4)
- @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive (1.6.11) — [security advisory](https://github.com/advisories/GHSA-7W99-5WM4-3G79)
- Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (1.6.11) — [security advisory](https://github.com/advisories/GHSA-PW9M-5JXM-XR6H)
- Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows (1.6.11) — [security advisory](https://github.com/advisories/GHSA-2VG6-77G8-24MP)
- Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin (1.6.11) — [security advisory](https://github.com/advisories/GHSA-FMH4-WCC4-5JM3)
- Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE (1.6.2) — [security advisory](https://github.com/advisories/GHSA-WXW3-Q3M9-C3JR)
- Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption (1.6.0) — [security advisory](https://github.com/advisories/GHSA-392P-2Q2V-4372)
- Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation (1.4.17) — [security advisory](https://github.com/advisories/GHSA-P6V2-XCPG-H6XW)
- Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) (1.4.9) — [security advisory](https://github.com/advisories/GHSA-XG6X-H9C9-2M83)
- Better Auth affected by external request basePath modification DoS (1.4.2) — [security advisory](https://github.com/advisories/GHSA-569Q-MPPH-WGWW)
- Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions (1.4.0) — [security advisory](https://github.com/advisories/GHSA-WMJR-V86C-M9JJ)

### New APIs and options

- Added optional self-service signing key rotation for `private_key_jwt` clients. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Added `isContinuation` so users can complete authorization after selecting an organization. (1.7.9) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.9)

### Performance

- Reduced installation size while preserving OpenTelemetry instrumentation attributes. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)

### Fixes and other changes

- Fixed metadata refreshes overwriting concurrent administrator changes to discovered clients. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Plugin init returns with options: undefined now pass type checks under exactOptionalPropertyTypes. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Fixed repeated PostgreSQL migration diffs for int8 columns. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Fixed the OpenAPI schema to match the endpoint's redirect response. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Fixed the OpenAPI schema to match the endpoint's redirect response. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Fixed Expo social account linking with ID tokens when a session cookie is present. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Fixed database-backed rate limiting returning an excessively large X-Retry-After value. (1.7.11) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.11)
- Google One Tap now honors the plugin-level `autoSelect` setting. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Fixed subpath imports and type resolution for this plugin path. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Fixed imports from this path failing with a not-exported error. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Fixed subpath imports and type resolution for this path. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Google One Tap now honors the plugin-level `cancelOnTapOutside` setting. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Errors for unknown OAuth `client_id` values now say `client not found`. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Device-code clients can refresh access for approved resources omitted from a token poll. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Valid DPoP proofs are no longer rejected for parameterized routes or URLs with trailing slashes. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Requests containing both supported and unsupported grants are no longer rejected. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Google One Tap no longer calls a prompt method unsupported by FedCM or retries skipped prompts. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Google One Tap sign-ins now record `google` as the last login method. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Google One Tap sign-ins now respect configured Google profile mapping and user info updates. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Native clients with HTTP loopback callbacks are no longer rejected when application type inference is enabled. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Unreachable JWKS endpoints are reported as server errors instead of invalid tokens. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- `findMany` now respects ID sorting, avoiding potentially repeated or skipped paginated results. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Unknown OAuth clients now receive `invalid_client` instead of `invalid_grant`. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- PKCE verifier errors now return the specified HTTP 400 response and error code. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Attempts to change cached trusted clients now return HTTP 400 instead of HTTP 500. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Unverifiable JWT access tokens no longer cause server errors at userinfo, introspection, or revocation endpoints. (1.7.10) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.10)
- Handlers finish before responses are sent, and failures are logged without interrupting requests. (1.7.9) — [release notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.9)