Better Auth Critical Vulnerabilities
Comments on “Better Auth Critical Vulnerabilities”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Better Auth released v1.7.16 and v1.8.0-beta.5 to fix 12 security advisories, one critical, three high, seven medium or lower by its own ratings. The critical flaw is in the Expo package, where the authorization proxy can sign values it did not issue. High-severity issues include unverified phone number claims and Electron sign-in returning the server secret and skipping two-factor. The project says Vercel applied WAF protections, a claim without independent confirmation. Teams should update every @better-auth package together and check plugin advisories for new configuration steps, such as trusted origins.
Why it ranked
No. 16 of 139 with a score of 0.71. The panel rated it highest on practical relevance (0.91) and new information (0.83), lowest on technical depth (0.48). Placed No. 16, No. 11 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Coordinated security release of a widely used auth library with 12 advisories, including a critical flaw; highly actionable for builders using it, but a vendor advisory with limited technical depth in the body.
- AI judgeJudge 3gpt-5.6-luna
- A primary security release discloses twelve vulnerabilities across authentication, authorization, sessions, OTP, billing, and passkeys, with fixed versions and upgrade guidance. It is highly actionable for users of the blinded package, though technical exploit detail is limited.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.71total under rubric v2.3
- Significance0.63
- Reader interest0.83
- Audience breadth0.49
- Practical relevance0.91
- Substantiated0.74
- Technical depth0.48
- New information0.83
- Counts against: Promotional0.07
- Counts against: Overclaim0.10
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.68 | 0.50 | 0.72 | 0.63 | 0.22 | +0.24 | +0.152 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.84 | 0.70 | 0.95 | 0.83 | 0.25 | +0.26 | +0.216 |
| Audience breadthHow many people who build technology does it concern? | 0.41 | 0.50 | 0.55 | 0.49 | 0.14 | +0.13 | +0.063 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.98 | 0.85 | 0.90 | 0.91 | 0.13 | +0.22 | +0.200 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.77 | 0.60 | 0.84 | 0.74 | 0.24 | +0.05 | +0.037 |
| Technical depthHow technically substantive is it? | 0.62 | 0.35 | 0.48 | 0.48 | 0.27 | +0.05 | +0.024 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.82 | 0.70 | 0.98 | 0.83 | 0.28 | +0.05 | +0.042 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.07 | 0.10 | 0.05 | 0.07 | 0.05 | −0.19 | −0.014 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.18 | 0.10 | 0.03 | 0.10 | 0.15 | −0.11 | −0.011 |
| Sum of contributions | +0.709 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.709 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-05/16/"><img src="https://rubric.hrih.si/badge/2026-11-05/16.svg" alt="Ranked #16 on Rubric, 5 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 4 matches source · 3 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkVersion
Better Auth v1.7.16 and v1.8.0-beta.5 fix the issues described in 12 security advisories published on GitHub Security Advisories.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “They fix the issues described in 12 security advisories, published today on”
The source says No passage could be compared.
Source cited by the article: github.com/better-auth/better-auth/security/advisories
Matches sourceVersion
Better Auth's Expo package has a critical vulnerability where the authorization proxy can sign values it did not issue, fixed in 1.7.16 and 1.8.0-beta.5.
The cited source says the same thing.
The article says “Authorization proxy can sign values it did not issue”
The source says “Upgrade both @better-auth/expo and better-auth to 1.7.16, or to 1.8.0-beta.5 on the beta line”
Source cited by the article: github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg
Matches sourceVersion
A high-severity phone number vulnerability in Better Auth allows phone numbers to be claimed before they are verified.
The cited source says the same thing.
The article says “Phone numbers can be claimed before they are verified”
The source says “Unverified numbers. Sign-up and other flows could save a phone number on an account before anyone proved they own it”
Source cited by the article: github.com/better-auth/better-auth/security/advisories/GHSA-q747-mqgr-4gh7
Matches sourceVersion
A high-severity Electron vulnerability in Better Auth lets desktop sign-in return the server secret and skip two-factor authentication.
The cited source says the same thing.
The article says “Desktop sign-in can return the server secret and skip two-factor”
The source says “A normal sign-in could return the server's internal auth context instead of the usual response. That context includes the auth secret and the client secrets of configured social providers”
Source cited by the article: github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc
Matches sourceVersion
Better Auth's MySQL serial ID handling in @better-auth/kysely-adapter can return another request's record.
The cited source says the same thing.
The article says “MySQL serial IDs can return another request's record”
The source says “After inserting a row, the adapter read the new ID back with a separate query. On a connection pool, that query could run on a different connection and return the…”
Source cited by the article: github.com/better-auth/better-auth/security/advisories/GHSA-48c2-w96j-mv3m
No source givenCausal conclusion
Vercel has applied WAF protections against all reasonably identifiable issues for apps deployed on Vercel.
The article gives no link or citation for it.
The article says “we've applied WAF protections against all reasonably identifiable issues”
The source says No source to compare with.
No source givenVersion
Separately released Better Auth packages such as @better-auth/expo, electron, passkey, stripe and kysely-adapter ship with the same versions as the core fix.
The article gives no link or citation for it.
The article says “Packages released separately, such as @better-auth/expo, @better-auth/electron, @better-auth/passkey, @better-auth/stripe and @better-auth/kysely-adapter, ship with the same versions”
The source says No source to compare with.
No source givenNumber
Better Auth's ongoing security reviews include work with frontier AI models made available through OSS security programs.
The article gives no link or citation for it.
The article says “Our ongoing security reviews include work with frontier AI models made available through OSS security programs”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 5 Nov 2026, 05:46 UTC. It played no part in the ranking.