AIKIDO-2026-10479
better-auth is vulnerable to Insufficient Authentication
75
High Risk
This Affects:
better-authTL;DR
The two-factor plugin did not consistently run its enforcement hook on every code path that creates a new session. Sign-in methods such as magic links, OAuth, passkeys, email OTP, and SIWE could therefore establish a session without satisfying configured second-factor requirements. The fix runs the post-hook whenever a new session is created, while excluding routine authenticated requests that only refresh or update an existing session.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Insufficient Authentication in versions 0.0.1 - 1.6.2.
How to fix this
Upgrade the better-auth library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant