AIKIDO-2026-32209
better-auth is vulnerable to Improper Input Validation
59
Medium Risk
This Affects:
better-authTL;DR
The experimental oauthPopup plugin merges caller-supplied additionalData into OAuth state without stripping reserved internal keys such as callbackURL and codeVerifier. An attacker who can influence the popup start request can inject those fields and tamper with the OAuth flow. Before the fix, reserved keys from additionalData were accepted into server-side OAuth state. The fix filters INTERNAL_STATE_KEYS so only custom application data is stored.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and have enabled the experimental oauthPopup plugin.
Background info
better-auth is vulnerable to Improper Input Validation in versions 1.6.17 - 1.6.18.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant