Better Auth's November Security Release: What to Patch and Rotate Today
Better Auth published a coordinated security release on November 3, 2026. It covers 12 advisories across core and its plugins : one critical, two high, eight medium and one low. If your SaaS uses Better Auth, upgrade today. For some setups, upgrading is not enough. The critical and Electron fixes also need secret rotation, and the phone and Stripe fixes need a data check, because a patch does not…
On November 3, 2026, Better Auth announced a security release addressing 12 security advisories affecting its core and plugins. The most critical issues include a critical vulnerability in the Expo authorization proxy (CVSS 9.1), a high-risk issue in Electron desktop sign-in (CVSS 8.1), and high-risk problems with the phone number and Stripe plugins (both CVSS 8.1).
The critical Expo authorization proxy vulnerability allows an attacker to sign in to a user's account using only their email address, without any additional credentials. This is made possible by a public endpoint that registers the expo() plugin and signs a value from the request with the application secret. The Electron desktop sign-in flaw enables any signed-in user to read the auth secret and social provider client secrets.
For those affected, a coordinated approach to patching and rotating secrets is advised. Teams should upgrade all Better Auth packages to version 1.7.16, or 1.8.0-beta.5 if already on the beta line. In cases where an upgrade is not immediately possible, a workaround should be implemented. Following the upgrade, teams should remove any usage of the problematic plugins, including the expo(), electron(), phoneNumber(), and stripe() functions.
Additionally, teams must rotate their application secret, as well as secrets for social provider clients, if the compromised endpoints were reachable during the vulnerability period. Teams using the Stripe plugin should check for any customer IDs held by multiple users, comparing them with the metadata.userId from the Stripe customer record.
After upgrading, it is important to verify that all packages are installed correctly and that the endpoint behavior has changed as expected. Run tests to ensure that password, social, and mobile sign-in functions are working correctly, and review logs for any unexpected activity. While monitoring for successful implementation, teams should remember that complete assurance of security is only achieved after thorough verification of all changes.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
