# Better Auth November 2026 security release Written by Vercel Security Team --- The Better Auth team has [shipped a coordinated security release](https://better-auth.com/blog/security-release-2026-11-03) addressing 12 advisories across authentication bypass, account takeover, session revocation, authorization checks, and billing. Better Auth 1.7.16 and 1.8.0-beta.5 are [available on npm](https://www.npmjs.com/package/better-auth) now. One advisory, in `@better-auth/expo`, is rated critical (CVSS 9.1). Vercel created new rules to address these vulnerabilities and deployed them to the Vercel WAF to automatically protect all projects hosted on Vercel at no cost. No configuration changes or redeploys are required. However, do not rely on the WAF for full protection. Immediate upgrades to a patched version are required, and some applications also require additional key rotation, cleanup, and configuration steps. ## Required action Upgrade `better-auth` and every `@better-auth/*` package you use to 1.7.16, or to 1.8.0-beta.5 on the beta line. Read the advisories for the plugins you use, since some fixes add a configuration step, such as listing trusted origins. If your server registers the `expo()` plugin, rotate your application secret after upgrading (see [Impact on Vercel deployments](https://vercel.com/kb/bulletin/better-auth-november-2026-security-release#impact-on-vercel-deployments)). ## Impact The release addresses the following advisories. Each advisory lists the affected versions and the conditions that decide whether you are affected. ### Critical #### [Expo](https://better-auth.com/blog/security-release-2026-11-03#expo) - [**Authorization proxy can sign values it did not issue**](https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading: Rotate the application secret if the vulnerable Expo endpoint was reachable. If SSO sign-in stops working, add the identity provider's origin to `trustedOrigins`. ### High #### [Phone number](https://better-auth.com/blog/security-release-2026-11-03#phone-number) - [**Phone numbers can be claimed before they are verified**](https://github.com/better-auth/better-auth/security/advisories/GHSA-q747-mqgr-4gh7) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading to 1.7.16: Remove previously saved phone numbers whose verification was never completed. Those users will need to add their numbers again. Version 1.8.0-beta.5 also checks account ownership before verifying a pending number, including numbers stored before the upgrade. #### [Electron](https://better-auth.com/blog/security-release-2026-11-03#electron) - [**Desktop sign-in can return the server secret and skip two-factor**](https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading: If an affected version of the Electron server plugin has been running, assume the authentication secret and all configured social provider client secrets were exposed. Rotate all of them; the upgrade cannot reverse an earlier disclosure. ### Medium #### [Core](https://better-auth.com/blog/security-release-2026-11-03#core) - [**Email-change links stay valid after the address changes hands**](https://github.com/better-auth/better-auth/security/advisories/GHSA-hwq2-v29r-p69r) - Fixed in: 1.7.16, 1.8.0-beta.5 - [**OAuth sign-in can treat an unverified provider email as verified**](https://github.com/better-auth/better-auth/security/advisories/GHSA-9hm7-xhfp-cx58) - Fixed in: 1.7.16, 1.8.0-beta.5 - [**MySQL serial IDs can return another request's record**](https://github.com/better-auth/better-auth/security/advisories/GHSA-48c2-w96j-mv3m) (`@better-auth/kysely-adapter` and `@better-auth/drizzle-adapter`) - Fixed in: 1.7.16, 1.8.0-beta.5 - [**Revoked sessions can stay valid with secondary storage or the cookie cache**](https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x) - Fixed in: 1.7.16, 1.8.0-beta.5 #### [Email OTP](https://better-auth.com/blog/security-release-2026-11-03#email-otp) - [**Email OTP attempt limit can be raced and codes are loosely bound to addresses**](https://github.com/better-auth/better-auth/security/advisories/GHSA-2f9c-7xj7-gh55) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading: Users with pending email changes must request fresh codes; codes issued before the upgrade no longer work. #### [Admin](https://better-auth.com/blog/security-release-2026-11-03#admin) - [**Admin roles with**](https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j) [`user:update`](https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j) [**can change another user's phone number**](https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j) - Fixed in: 1.7.16, 1.8.0-beta.5 - Configuration: For custom access controls, include `set-phone` in the permission statements and assign `user:set-phone` only to roles authorized to change users' phone numbers. The default admin role already includes this permission. #### [Organization](https://better-auth.com/blog/security-release-2026-11-03#organization) - [**Organization admins can invite an owner with a padded role name**](https://github.com/better-auth/better-auth/security/advisories/GHSA-c85h-5mrr-mgx4) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading: Audit existing invitations and memberships for role strings affected by whitespace trimming, and review owners invited by those members. Do not automatically trim stored roles: this can activate unintended owner privileges. #### [Stripe](https://better-auth.com/blog/security-release-2026-11-03#stripe) - [**Billing actions can target another customer's Stripe account**](https://github.com/better-auth/better-auth/security/advisories/GHSA-x8j7-xh58-rv6x) - Fixed in: 1.7.16, 1.8.0-beta.5 - After upgrading: Find Stripe customer IDs associated with multiple users and verify those associations against the customer's `metadata.userId` in Stripe. Check organization records too if organization billing is enabled. The patch does not repair previously stored associations. ### Low #### [Passkey](https://better-auth.com/blog/security-release-2026-11-03#passkey) - [**Passkey verification does not enforce origin or user verification**](https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm) - Fixed in: 1.7.16, 1.8.0-beta.5 - Configuration: Set an explicit `origin` if you configure `rpID` and that domain is covered by a wildcard in `baseURL.allowedHosts`. ## Impact on Vercel deployments Vercel deployed WAF rules that block the exploitable request patterns for the advisories that can be identified at the request layer, including the critical `@better-auth/expo` issue. Logic-level issues, such as session revocation with secondary storage, cannot be blocked by a WAF and are fixed only by upgrading. WAF rules reduce exposure but do not replace patching. The WAF blocks new exploit attempts but cannot invalidate signatures forged before the rules were deployed, so applications using the `expo()` plugin should upgrade and rotate their application secret. ## Resolution Patching is required for complete mitigation, and some applications also require additional key rotation, cleanup, and configuration steps. Upgrade every Better Auth package together. Packages released separately, such as `@better-auth/expo`, `@better-auth/electron`, `@better-auth/passkey`, `@better-auth/stripe`, and `@better-auth/kysely-adapter`, ship with the same version numbers as `better-auth`. For applications on the 1.7.x line: `npm install better-auth@1.7.16` For applications on the 1.8.0 beta line: `npm install better-auth@1.8.0-beta.5` If Expo sign-in through an SSO identity provider fails after upgrading, add the identity provider's origin to `trustedOrigins`. If you can't upgrade immediately and you don't use Expo social sign-in, remove the `expo()` server plugin. Otherwise, block requests to `/expo-authorization-proxy` (under your auth base path) whose `authorizationURL` carries a `state` value that is not exactly 32 characters from `A-Z`, `a-z`, `0-9`, `-`, and `_`. This workaround blocks the signing problem only. ## Affected versions | **Package** | **Affected** | **Upgrade to** | | ------------------------------- | --------------------------------------------------------- | ---------------------- | | `better-auth` 1.7.x and earlier | <1.7.16 | 1.7.16 | | `better-auth` 1.8.0-beta.x | \>=1.8.0-beta.0, <1.8.0-beta.5 | 1.8.0-beta.5 | | `@better-auth/expo` | \>=1.4.0-beta.6, <1.7.16 or >=1.8.0-beta.0, <1.8.0-beta.5 | 1.7.16 or 1.8.0-beta.5 | | Other `@better-auth/*` packages | See each advisory | 1.7.16 or 1.8.0-beta.5 | ## Fixed in **Better Auth**: 1.7.16, 1.8.0-beta.5 All `@better-auth/*` packages: same versions ## References - [Better Auth security release, November 3, 2026](https://better-auth.com/blog/security-release-2026-11-03) - [Better Auth GitHub Security Advisories](https://github.com/better-auth/better-auth/security/advisories) - [GHSA-4wq4-2ppv-q3hg (critical,](https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg) [`@better-auth/expo`](https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg)[)](https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg) --- Read our [security guides](/kb/security) to learn about deployment protection, bot prevention, and rate limiting. Browse [all security bulletins](/kb/bulletin) for security updates and advisories. ## Reference Architecture Choose a stack and work through the decisions behind it, with curated documentation, guides, templates, and courses to help you build. - [Agent stack](/kb/architecture/agents): Build and operate agents with models, tools, and durable workflows. - [Web applications](/kb/architecture/web): Choose rendering, data, authentication, and caching approaches. - [Backends](/kb/architecture/backends): Choose a runtime, connect services, and run background work. [Browse all stacks](/kb/architecture)