@BETTER-AUTH/ELECTRON · GHSA-9p5w-h4pr-fcrc · Package
FIX → 1.8.0-beta.5 +1
The @better-auth/electron plugin can return Better Auth's internal server context, including the auth secret and social provider client secrets, in a normal sign-in response. A password sign-in can also create a desktop sign-in code before the second factor is checked, which can be exchanged for a full session.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers that register the electron() plugin from @better-auth/electron at 1.5.0-beta.12 or later are exposed to the secret leak. The two-factor bypass also requires twoFactor() to be registered, electron() to appear before it in the plugins array, and users with two-factor enabled to be able to sign in with a password. Servers without the Electron plugin are not affected.
Not affected if default-config, no-electron-plugin
Who cares authentication, better-auth, electron, node
@better-auth/electron and better-auth in your lockfile or with npm ls @better-auth/electron.electron() from @better-auth/electron.You are affected if your server registers the electron() plugin from @better-auth/electron 1.5.0-beta.12 or later.
The two-factor problem below also needs all of these:
twoFactor().electron() appears before twoFactor() in the plugins array.Server secret in the sign-in response. A normal sign-in could return the server's internal auth context instead of the usual response. That context includes the auth secret and the client secrets of configured social providers.
Two-factor skipped. A password sign-in could create a desktop sign-in code before the second factor was checked. That code could be exchanged for a full session.
Any user who can sign in can read the auth secret and the social provider client secrets. With the auth secret, they can create signed values the server trusts and get a session as another user whose email address they know. The victim does not need to do anything.
With the two-factor problem, an attacker who knows a user's password can get a session for that user without the second factor.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
twoFactor(), check whether electron() appears before it in the plugins array.Upgrade to 1.8.0-beta.5 +1
@better-auth/electron and better-auth: 1.7.16 on the stable line@better-auth/electron and better-auth: 1.8.0-beta.5 on the beta lineUpgrade @better-auth/electron and better-auth to 1.7.16, or to 1.8.0-beta.5 on the beta line.
If the plugin has been running, treat the auth secret and every social provider client secret as disclosed, and rotate them. Upgrading does not undo a disclosure that already happened.
Remove the electron() plugin from your server until you upgrade. This disables desktop sign-in.
Placing twoFactor() before electron() blocks the confirmed two-factor path on recent better-auth releases, but it does not fix the server secret problem.
After sign-in, the plugin reads a signed transfer cookie to start the desktop handoff. It accepted any value with a valid signature. A signature covers only the cookie value, not its name, so another signed cookie issued during sign-in could be sent back under the transfer cookie name. When no valid transfer request was found, the plugin's after hook returned the whole endpoint context, which Better Auth sent as the response.
For two-factor, the plugin stored the desktop authorization code while the temporary password session still existed. Desktop authorization codes are now bound to the browser session that issued them and stop working once that session ends, whatever the plugin order.
The server secret problem was discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-R8Z0P3MG. A related path through anonymous sign-in was discovered by the same scanner, as vulnerability ANT-2026-DDHILQ2X.