Better Auth Critical Vulnerabilities

Better Auth released v1.7.16 and v1.8.0-beta.5 to fix 12 security advisories, one critical, three high, seven medium or lower by its own ratings. The critical flaw is in the Expo package, where the authorization proxy can sign values it did not issue. High-severity issues include unverified phone number claims and Electron sign-in returning the server secret and skipping two-factor. The project says Vercel applied WAF protections, a claim without independent confirmation. Teams should update every @better-auth package together and check plugin advisories for new configuration steps, such as trusted origins.