Octane Security Behind Two Better Auth Flaws: 2FA Bypass (8.1) and Stripe Hijack (5.9)
thedealdirector · x · 2026-11-04
Better Auth's upcoming security release (Nov 3, 2026) stems from findings by Octane Security: a High-severity (CVSS 8.1) 2FA bypass in @better-auth/electron where desktop sign-in can return the server's internal auth context and skip two-factor, letting attackers forge sessions; and a Moderate (5.9) flaw in @better-auth/stripe where users could overwrite their Stripe customer ID to open another customer's billing portal and change or cancel subscriptions. Fixed in 1.7.16 / 1.8.0-beta.5.
More from Safety
- OffsecCyber dataset combines HackerOne reports and CVEs to train pentesting LLMs — AccBalanced · 2026-11-04
- Abliterated GLM-5.3 pulls off red-team exploit in 3:41 for $0.02, stock model refuses — bratton · 2026-11-04
- AI industry bet on both parties: $55M+ spent this election cycle via dual PACs — ChrisGPT · 2026-11-04
- Valid tokens, allowed actions, zero intent checks: the agent security gap nobody solves — Cytersmyz · 2026-11-04
- Princeton paper: harsher penalties can make AI auditors inspect less — Few-Decision6287 · 2026-11-04
- All 41 local data center moratoria on US ballots predicted to fail 0-41 — jekbradbury · 2026-11-04