better-auth

The most comprehensive authentication framework for TypeScript.

Latest 1.7.7

88%

Total Score

healthy

Healthy release with active maintenance and verified publishing, though three workflows use broadly scoped GitHub App tokens.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 20 workflows were analyzed, all 78 action references are pinned, and every workflow has read-only permissions. However, three high-confidence findings show GitHub App tokens inheriting blanket installation permissions; this is a workflow credential-hygiene concern, though no untrusted checkout or script injection was found.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-373183 New better-auth is vulnerable to Improper Authentication in versions 1.3.18 - 1.7.6.	1.3.18 - 1.7.6	Critical
AIKIDO-2026-906996 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. better-auth is vulnerable to User Enumeration in versions 1.3.7 - 1.6.25.	1.3.7 - 1.6.25	Medium
AIKIDO-2026-204536 better-auth is vulnerable to Insecure Cryptographic Defaults in versions 0.0.1 - 1.6.10.	0.0.1 - 1.6.10	High
AIKIDO-2026-379318 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. better-auth is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.1.0 - 1.6.23.	0.1.0 - 1.6.23	Medium
CVE-2026-53516 better-auth is vulnerable to Improper Authentication in versions 0.0.0 - 1.6.11.	0.0.0 - 1.6.11	High