Security update: June 2026

Better Auth 1.6.14 is the current stable release. Stable projects should update to the latest 1.6.x version.

This update bundles a number of fixes, and we have published GitHub advisories for every reported issue. Some advisories affect scoped packages such as @better-auth/sso, @better-auth/scim, or @better-auth/oauth-provider. Update any Better Auth packages you install directly, not only the top-level better-auth package.

pnpm add better-auth@latest

Most stable-line advisories are covered by the latest 1.6.x release. A few advisories require the next package channel or a documented workaround because the complete fix changes behavior. In those cases, follow the linked advisory for the exact upgrade path.

We have also started a dedicated security-review workstream across Better Auth and its plugins. It covers report triage, focused code review, automated and manual scanning, variant analysis, patch review, release coordination, and advisory publication.

Published Advisories

The tables below cover the advisories published in this security cycle, grouped by the affected component. The full historical list remains available in the Security Advisories tab.

Core (better-auth)

Organization

Device Authorization

OAuth Provider (@better-auth/oauth-provider)

SCIM (@better-auth/scim)

SSO (@better-auth/sso)

Deprecated plugins (OIDC and MCP)

The oidcProvider and mcp plugins have been deprecated for roughly half a year and will be removed from the library in 1.7. For the advisories below we strongly recommend migrating to @better-auth/oauth-provider rather than relying on continued patches to these plugins.

Each advisory has the exact affected ranges, fixed versions, and package names. The tables are a quick index, not a replacement for the advisory body. If your project uses one of the affected plugins, read the linked advisory before deciding that a top-level better-auth update is enough.

Stable and Breaking Fixes

Security fixes often sit between two constraints: users need a patch quickly, and stable releases should not break existing applications unless there is no safe alternative.

Our stable line is still the first place we try to ship a fix. When the fix can preserve public types, defaults, and request or response shapes, it goes into the following 1.6.x release. That is the preferred path because most users can update without changing application code.

Some issues require a stronger default or a different API contract. In those cases, we have three options:

• Ship a compatible stable fix and document the stricter configuration.
• Ship the complete fix through the next package channel when stable compatibility would hide the risk.
• Publish a workaround in the advisory when the stable line cannot safely take the breaking change.

If a compatibility release changes the recommended secure posture after publication, we will update the advisory body and metadata. Release notes alone are not enough for downstream audit tools.

How to Stay Current

• Update stable projects to better-auth@latest. As of this update, that is 1.6.14.
• Update next channel projects to the version named in the advisory. Several current advisories point to 1.7.0-beta.4.
• Update scoped Better Auth packages too. Several advisories affect packages such as @better-auth/sso, @better-auth/scim, and @better-auth/oauth-provider.
• Watch the repository releases. The Releases page shows each patch release.
• Watch the advisory feed. The Security Advisories tab is the source of truth for affected and fixed ranges.
• Run audit tools against your lockfile. GitHub Dependabot and npm audit both consume advisory metadata.

Thanks

Thank you to the researchers, contributors, maintainers, and users who reported issues, tested fixes, and reviewed patches during this cycle. As LLMs lower the bar for attackers, especially in open source software, covering the surfaces that matter and responding to the community's security reports remains one of our top priorities.