Hoch
CVE-2026-67327
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 34
Filter zurücksetzen
Hoch
CVE-2026-67329
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
Kritisch
CVE-2026-67330
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
Hoch
CVE-2026-53515
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
Hoch
CVE-2026-67331
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
Niedrig
CVE-2026-67334
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
Hoch
CVE-2026-53518
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
Kritisch
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
Hoch
CVE-2026-53517
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
Hoch
CVE-2026-67336
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
Hoch
CVE-2026-67333
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Hoch
CVE-2026-53516
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
Hoch
CVE-2026-53514
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
Mittel
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Kritisch
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Hoch
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Hoch
CVE-2026-45364
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation
Mittel
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
Kritisch
ghsa-47wq-cj9q-wpmp
Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys
Hoch
CVE-2026-41427
OAuth 2.1 Provider: Unprivileged users can register OAuth clients
Kritisch
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Kritisch
CVE-2026-67337
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)
Niedrig
CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
Hoch
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.