AIKIDO-2026-906996
better-auth is vulnerable to User Enumeration
45
Medium Risk
This Affects:
better-authTL;DR
The email OTP plugin exposes a check-verification-otp endpoint that looks up the account by email before validating the submitted one-time code. Because a missing account and a wrong code return different errors, an unauthenticated caller can submit an arbitrary code to learn whether an email is registered. This enables account and email enumeration against the authentication server. The fix validates the OTP first and only reveals account existence after possession of the code is proven.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the email OTP plugin.
Background info
better-auth is vulnerable to User Enumeration in versions 1.3.7 - 1.6.25.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant