AIKIDO-2026-379318
better-auth is vulnerable to Cross-Site Request Forgery (CSRF)
53
Medium Risk
This Affects:
better-authTL;DR
The magic-link (/sign-in/magic-link) and email-OTP (/email-otp/send-verification-otp) plugin send endpoints do not validate the Origin header on cookieless requests. A cookieless cross-origin POST is accepted and triggers an outbound magic-link or verification email to the address supplied in the request body, so an attacker can drive emails to arbitrary recipients from the victim application. The equivalent built-in /sign-in/email and /sign-up/email routes already enforced this origin check, but the plugin send routes were not covered. The fix attaches the shared CSRF/origin middleware to both plugin send endpoints while still allowing legitimate server-to-server requests that carry no Origin header.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the magic link or email OTP plugin.
Background info
better-auth is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.1.0 - 1.6.23.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant