Contributions

~GHSA-q747-mqgr-4gh7

typescriptsecurityauthenticationcwe-287

better-auth/better-auth

Phone numbers can be claimed before they are verified

Sign-up and other flows stored a phone number on an account before anyone proved they owned it, and phone OTP sign-in looked the account up by number without requiring phoneNumberVerified. An attacker could save a victim's number on an account they control, so the victim's own valid code signed them into the attacker's account. Verification codes also shared a namespace with other flows, so a predictable record identifier cancelled another user's pending code. CVSS 8.1, fixed in 1.7.16.

~GHSA-x8j7-xh58-rv6x

typescriptsecurityaccess-controlcwe-639

better-auth/better-auth

Stripe plugin: billing actions can target another customer's Stripe account

stripeCustomerId lived on the user record without input: false, so the generic sign-up and update-user routes accepted it and a user could replace their own with another customer's. The billing portal, checkout and webhook handling then treated that customer as theirs, exposing invoices and billing details and allowing payment-method, cancellation and plan changes. CVSS 5.9, fixed in @better-auth/stripe 1.7.16.

~GHSA-c85h-5mrr-mgx4

typescriptsecurityprivilege-escalationcwe-863

better-auth/better-auth

Organization admins can invite an owner with a padded role name

The organization plugin compared the raw invitation role against the creator role, while every later check split and trimmed it, so " owner" passed the non-owner guard and became owner once the invitation was accepted. An admin could invite an account they control as a real owner, which can then delete the organization and remove the original owners. CVSS 4.9, fixed in 1.7.16.

~GHSA-gv75-j3v8-3crm

typescriptsecuritywebauthncwe-346

better-auth/better-auth

Passkey verification does not enforce origin or user verification

The passkey handlers took the expected WebAuthn origin from the request rather than from configuration, and never checked the user-verification flag they had asked the authenticator to set. A passkey could be registered or used without the PIN or biometric the application required, and a response minted on another origin under the same rpID was accepted. CVSS 3.1, fixed in @better-auth/passkey 1.7.16.

pythonsecurityprivilege-escalationcwe-269

~CVE-2026-74035

CVEPublished

wazuh/wazuh

An empty password bypasses both the password policy and the reserved user guard in security.update_user

update_user kept the length check, the complexity check and the reserved-user guard behind an if password: block, and an empty string is falsy in Python, so all three were skipped. The ORM had no reserved-ID check of its own, so a delegated user administrator could blank the password of the wazuh superuser and sign in as it over basic auth. CVSS 7.2, fixed in 4.14.8.

$ October 2026open ↗

~CVE-2026-93346

CVEPublished

wazuh/wazuh

API brute-force protection is still bypassable by concurrent login requests

An earlier fix put the per-IP failed-login counter behind a lock, which made its updates atomic but left the window between the block check at the start of a request and the failure only counted after credential validation. Concurrent requests all clear the check before any failure lands, so max_login_attempts stops applying; a local simulation put 100 of 100 parallel attempts through a limit of 5. CVSS 5.3, fixed in 4.14.8.

pythonsecurityrace-conditioncwe-307

$ October 2026open ↗

~GHSA-r4xp-prcw-77qf

typescriptsecurityauthenticationcwe-287

better-auth/better-auth

OAuth Proxy lets an attacker sign in as another user

The OAuth Proxy plugin trusted any profile it could decrypt, and with a cookie state store it shared a secret with sign-in state that carries caller-chosen data. An attacker who knew a user's email could forge a profile and sign in as them. CVSS 7.4, fixed in 1.7.7.

swiftsecurityresource-exhaustionoci

~#932

PROpen

apple/containerization

Stop filling the disk when pulling images with oversized blobs

Blob downloads accepted a Content-Length larger than the descriptor and never compared the bytes actually received against it, so the write never stopped. Downloads are now bounded by the descriptor size and an oversized body is refused before anything lands on disk. Credited as reporter.

swiftsecurityresource-exhaustionzstd

~#931

PROpen

apple/containerization

Stop leaking disk space when unpacking images with zstd layers

Uncompressed zstd layers were written to temp directories with no size limit, and those directories were left behind when decompressing a later layer failed or was cancelled. zstd layers now stream through decompression, so no copy is written to disk. Credited as reporter.

~Apple 149035

AdvisoryAcknowledged

apple/xnu

Missing headroom check on TX checksum offset causes kernel OOB copy

Skywalk's TX metadata validation checked the checksum start offset against the packet length but never against its headroom, so dp_copy_to_dev_pkt computed start minus headroom, wrapped it as a uint16_t and used it as a copy length. An unprivileged process reached it over NECP on stock Wi-Fi and panicked the kernel. Fixed in iOS 27, iPadOS 27 and macOS Golden Gate 27, credited under Kernel.

csecuritykernelcwe-191

csecuritylog-injectioncrlf

~#38692

PRMerged

wazuh/wazuh

Sanitize the Fluentd server strings written to the log

The fluent-forward module logged three strings straight from the collector — the PONG rejection reason and server hostname, and unexpected HELO keys — without filtering, so a rogue collector could embed CRLF and forge entries in ossec.log. Credited as reporter.