AIKIDO-2026-10479
better-auth is vulnerable to Insufficient Authentication
75
High Risk
This Affects:
better-authTL;DR
The two-factor plugin did not consistently run its enforcement hook on every code path that creates a new session. Sign-in methods such as magic links, OAuth, passkeys, email OTP, and SIWE could therefore establish a session without satisfying configured second-factor requirements. The fix runs the post-hook whenever a new session is created, while excluding routine authenticated requests that only refresh or update an existing session.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Insufficient Authentication in versions 0.0.1 - 1.6.2.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.