package @better-auth/cimd
No problems found
No problems found for version 1.7.14. Earlier public reports name other versions (listed just below). Pin 1.7.14 exactly.
Earlier reports: Versions before 1.6.11 were affected (Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email, Jul 7, 2026, GHSA-g38m-r43w-p2q7, link). Versions 1.1.3 up to, but not including, 1.6.22 and versions 1.7.0-beta.0 up to, but not including, 1.7.0-beta.10 were affected (Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in, Jul 24, 2026, GHSA-qq9h-g4jm-xgf3, link). The current version, 1.7.14, is not named.
- Latest version
- 1.7.14
- First published
- 2 years ago
- Maintainers
- 1
- Catalog grade
- A — Few risk signals
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
Threat reports
- Earlier versionBetter Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email (Jul 7, 2026, GHSA-g38m-r43w-p2q7, link)
- Earlier versionBetter Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in (Jul 24, 2026, GHSA-qq9h-g4jm-xgf3, link)
Install it pinned and without install scripts:
npm install --ignore-scripts --save-exact "better-auth@1.7.14"Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee. Answers change through the day.