{"id":"GHSA-9p5w-h4pr-fcrc","kind":"vulnerability","aliases":["GHSA-9p5w-h4pr-fcrc"],"related":[],"title":"@better-auth/electron: Desktop sign-in can return the server secret and skip two-factor","description":"## Am I affected?\r\n\r\nYou are affected if your server registers the `electron()` plugin from `@better-auth/electron` 1.5.0-beta.12 or later.\r\n\r\nThe two-factor problem below also needs all of these:\r\n\r\n- The server registers `twoFactor()`.\r\n- `electron()` appears before `twoFactor()` in the `plugins` array.\r\n- Users with two-factor turned on can sign in with a password.\r\n\r\n## Summary\r\n\r\n**Server secret in the sign-in response.** A normal sign-in could return the server's internal auth context instead of the usual response. That context includes the auth secret and the client secrets of configured social providers.\r\n\r\n**Two-factor skipped.** A password sign-in could create a desktop sign-in code before the second factor was checked. That code could be exchanged for a full session.\r\n\r\n## Impact\r\n\r\nAny user who can sign in can read the auth secret and the social provider client secrets. With the auth secret, they can create signed values the server trusts and get a session as another user whose email address they know. The victim does not need to do anything.\r\n\r\nWith the two-factor problem, an attacker who knows a user's password can get a session for that user without the second factor.\r\n\r\n## Patches\r\n\r\nUpgrade `@better-auth/electron` and `better-auth` to 1.7.16, or to 1.8.0-beta.5 on the beta line.\r\n\r\nIf the plugin has been running, treat the auth secret and every social provider client secret as disclosed, and rotate them. Upgrading does not undo a disclosure that already happened.\r\n\r\n## Workarounds\r\n\r\nRemove the `electron()` plugin from your server until you upgrade. This disables desktop sign-in.\r\n\r\nPlacing `twoFactor()` before `electron()` blocks the confirmed two-factor path on recent `better-auth` releases, but it does not fix the server secret problem.\r\n\r\n## Technical details\r\n\r\nAfter sign-in, the plugin reads a signed transfer cookie to start the desktop handoff. It accepted any value with a valid signature. A signature covers only the cookie value, not its name, so another signed cookie issued during sign-in could be sent back under the transfer cookie name. When no valid transfer request was found, the plugin's after hook returned the whole endpoint context, which Better Auth sent as the response.\r\n\r\nFor two-factor, the plugin stored the desktop authorization code while the temporary password session still existed. Desktop authorization codes are now bound to the browser session that issued them and stop working once that session ends, whatever the plugin order.\r\n\r\n## Credit\r\n\r\nThe server secret problem was discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-R8Z0P3MG. A related path through anonymous sign-in was discovered by the same scanner, as vulnerability ANT-2026-DDHILQ2X.","summary":"The @better-auth/electron plugin can return Better Auth's internal server context, including the auth secret and social provider client secrets, in a normal sign-in response. A password sign-in can also create a desktop sign-in code before the second factor is checked, which can be exchanged for a full session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@better-auth/electron","fixed":["1.7.16"],"affected":">= 1.5.0-beta.12, < 1.7.16","ecosystem":"npm"},{"name":"@better-auth/electron","fixed":["1.8.0-beta.5"],"affected":">= 1.8.0-beta.0, < 1.8.0-beta.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["authentication","better-auth","cwe-201","cwe-288","electron","node","package"],"not_affected_if":["default-config","no-electron-plugin"],"how_to_check":"- Check the installed version of `@better-auth/electron` and `better-auth` in your lockfile or with `npm ls @better-auth/electron`.\n- Confirm whether your server registers `electron()` from `@better-auth/electron`.\n- If you also use `twoFactor()`, check whether `electron()` appears before it in the `plugins` array.","fix":"- `@better-auth/electron` and `better-auth`: `1.7.16` on the stable line\n- `@better-auth/electron` and `better-auth`: `1.8.0-beta.5` on the beta line","status":"open","published_at":"2026-11-03T21:38:09+00:00","first_seen_at":"2026-11-09T22:53:19+00:00","triaged_at":"2026-11-09T22:54:15+00:00","updated_at":"2026-11-09T22:54:15+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-09T22:54:15Z","model":"claude-haiku-5-5","output":{"fix":"- `@better-auth/electron` and `better-auth`: `1.7.16` on the stable line\n- `@better-auth/electron` and `better-auth`: `1.8.0-beta.5` on the beta line","reach":"internet","title":"Better Auth Electron plugin: sign-in can leak server secrets and skip 2FA","impact":"high","summary":"The @better-auth/electron plugin can return Better Auth's internal server context, including the auth secret and social provider client secrets, in a normal sign-in response. A password sign-in can also create a desktop sign-in code before the second factor is checked, which can be exchanged for a full session.","audience":"developers","category":"package","nicknames":[],"who_cares":["better-auth","electron","node","authentication"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"any signed-in user reads the auth secret and create sessions as others","analyst_note":"Advisory notes that if the plugin ran, the auth secret and social client secrets should be treated as disclosed and rotated; confirm rotation guidance at https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc","how_to_check":"- Check the installed version of `@better-auth/electron` and `better-auth` in your lockfile or with `npm ls @better-auth/electron`.\n- Confirm whether your server registers `electron()` from `@better-auth/electron`.\n- If you also use `twoFactor()`, check whether `electron()` appears before it in the `plugins` array.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-electron-plugin","default-config"],"who_is_affected":"Servers that register the electron() plugin from @better-auth/electron at 1.5.0-beta.12 or later are exposed to the secret leak. The two-factor bypass also requires twoFactor() to be registered, electron() to appear before it in the plugins array, and users with two-factor enabled to be able to sign in with a password. Servers without the Electron plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000918,"input_tokens":5482,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-201':42B '-2026':540C,559C '-288':44B '/electron':4A,32A,36A,52B,123C,317C '1.5.0':124C '1.7.16':323C '1.8.0':326C '9p5w':21A,26A 'accept':424C 'address':276C 'affect':108C,111C 'alreadi':360C 'also':84B,134C 'anonym':546C 'anoth':272C,442C 'ant':539C,558C 'anthrop':533C 'anyth':286C 'appear':144C 'array':150C 'attack':294C 'auth':3A,31A,35A,40B,51B,57B,64B,122C,184C,195C,247C,257C,316C,321C,340C,394C,478C 'authent':37B 'author':492C,502C 'back':453C 'beta':330C 'beta.12':125C 'beta.5':327C 'better':2A,30A,34A,39B,50B,56B,121C,315C,320C,393C,477C 'better-auth':1A,29A,33A,38B,49B,120C,314C,319C,392C 'block':383C 'bound':506C 'browser':509C 'check':97B,227C 'client':69B,199C,253C,346C 'code':91B,221C,229C,493C,503C 'configur':202C 'confirm':385C 'context':61B,185C,192C,475C 'cooki':417C,436C,444C,457C 'could':178C,214C,230C,450C 'cover':433C 'creat':85B,215C,261C 'credit':525C 'cwe':41B,43B 'ddhilq2x':560C 'desktop':5A,87B,217C,375C,421C,491C,501C 'detail':406C 'disabl':374C 'disclos':349C 'disclosur':358C 'discov':531C,551C 'electron':45B,117C,143C,365C,382C 'email':275C 'end':520C 'endpoint':474C 'everi':343C 'exchang':101B,232C 'exist':500C 'factor':18A,95B,131C,155C,207C,225C,291C,311C,388C,486C 'fcrc':23A,28A 'fix':400C 'found':465C 'full':104B,235C 'get':268C,302C 'ghsa':20A,25A 'ghsa-9p5w-h4pr-fcrc':19A,24A 'h4pr':22A,27A 'handoff':422C 'happen':361C 'hook':470C 'impact':237C 'includ':62B,193C 'instead':186C 'intern':59B,183C 'issu':445C,512C 'know':278C,296C 'later':127C 'line':331C 'name':440C,458C 'need':135C,283C 'node':46B 'normal':73B,174C 'order':524C 'oss':535C 'packag':47B 'password':79B,163C,210C,300C,497C 'patch':312C 'path':389C,544C 'place':379C 'plugin':53B,118C,149C,334C,366C,412C,467C,488C,523C 'problem':132C,292C,404C,529C 'provid':68B,204C,252C,345C 'r8z0p3mg':541C 'read':245C,413C 'recent':391C 'regist':115C,141C 'relat':543C 'releas':395C 'remov':363C 'request':463C 'respons':77B,172C,190C,482C 'return':10A,55B,179C,471C 'rotat':351C 'run':337C 'scanner':536C,555C 'second':94B,224C,310C 'secret':13A,65B,70B,166C,196C,200C,248C,254C,258C,341C,347C,403C,528C 'sent':452C,479C 'server':12A,60B,114C,140C,165C,181C,265C,369C,402C,527C 'session':105B,236C,270C,304C,498C,510C,519C 'sign':7A,75B,81B,89B,159C,170C,176C,212C,219C,242C,262C,377C,409C,415C,443C,448C,548C 'sign-in':6A,74B,80B,88B,169C,175C,211C,218C,376C,408C,447C,547C 'signatur':430C,432C 'skip':15A,208C 'social':67B,203C,251C,344C 'start':419C 'still':499C 'stop':515C 'store':489C 'summari':164C 'technic':405C 'temporari':496C 'transfer':416C,456C,462C 'treat':338C 'trust':266C 'turn':156C 'two':17A,130C,154C,206C,290C,387C,485C 'two-factor':16A,129C,153C,205C,289C,386C,484C 'twofactor':142C,146C,380C 'undo':356C 'upgrad':313C,353C,372C 'user':151C,239C,273C,298C,307C 'usual':189C 'valid':429C,461C 'valu':263C,426C,437C 'victim':280C 'vulner':538C,557C 'whatev':521C 'whole':473C 'whose':274C 'without':308C 'work':516C 'workaround':362C","nicknames":[],"mitigations":[],"who_affected":"Servers that register the electron() plugin from @better-auth/electron at 1.5.0-beta.12 or later are exposed to the secret leak. The two-factor bypass also requires twoFactor() to be registered, electron() to appear before it in the plugins array, and users with two-factor enabled to be able to sign in with a password. Servers without the Electron plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["electron"],"ptokens":["auth","better","electron"],"labels":["authentication","betterauth","cwe201","cwe288","electron","high","node","npm","package"],"campaign_type":null,"search_a":"'/electron':4A,32A,36A '9p5w':21A,26A 'auth':3A,31A,35A 'better':2A,30A,34A 'better-auth':1A,29A,33A 'desktop':5A 'factor':18A 'fcrc':23A,28A 'ghsa':20A,25A 'ghsa-9p5w-h4pr-fcrc':19A,24A 'h4pr':22A,27A 'return':10A 'secret':13A 'server':12A 'sign':7A 'sign-in':6A 'skip':15A 'two':17A 'two-factor':16A","search_b":"'-201':42B '-288':44B '/electron':52B 'also':84B 'auth':40B,51B,57B,64B 'authent':37B 'better':39B,50B,56B 'better-auth':38B,49B 'check':97B 'client':69B 'code':91B 'context':61B 'creat':85B 'cwe':41B,43B 'desktop':87B 'electron':45B 'exchang':101B 'factor':95B 'full':104B 'includ':62B 'intern':59B 'node':46B 'normal':73B 'packag':47B 'password':79B 'plugin':53B 'provid':68B 'respons':77B 'return':55B 'second':94B 'secret':65B,70B 'server':60B 'session':105B 'sign':75B,81B,89B 'sign-in':74B,80B,88B 'social':67B","search_c":"'-2026':540C,559C '/electron':123C,317C '1.5.0':124C '1.7.16':323C '1.8.0':326C 'accept':424C 'address':276C 'affect':108C,111C 'alreadi':360C 'also':134C 'anonym':546C 'anoth':272C,442C 'ant':539C,558C 'anthrop':533C 'anyth':286C 'appear':144C 'array':150C 'attack':294C 'auth':122C,184C,195C,247C,257C,316C,321C,340C,394C,478C 'author':492C,502C 'back':453C 'beta':330C 'beta.12':125C 'beta.5':327C 'better':121C,315C,320C,393C,477C 'better-auth':120C,314C,319C,392C 'block':383C 'bound':506C 'browser':509C 'check':227C 'client':199C,253C,346C 'code':221C,229C,493C,503C 'configur':202C 'confirm':385C 'context':185C,192C,475C 'cooki':417C,436C,444C,457C 'could':178C,214C,230C,450C 'cover':433C 'creat':215C,261C 'credit':525C 'ddhilq2x':560C 'desktop':217C,375C,421C,491C,501C 'detail':406C 'disabl':374C 'disclos':349C 'disclosur':358C 'discov':531C,551C 'electron':117C,143C,365C,382C 'email':275C 'end':520C 'endpoint':474C 'everi':343C 'exchang':232C 'exist':500C 'factor':131C,155C,207C,225C,291C,311C,388C,486C 'fix':400C 'found':465C 'full':235C 'get':268C,302C 'handoff':422C 'happen':361C 'hook':470C 'impact':237C 'includ':193C 'instead':186C 'intern':183C 'issu':445C,512C 'know':278C,296C 'later':127C 'line':331C 'name':440C,458C 'need':135C,283C 'normal':174C 'order':524C 'oss':535C 'password':163C,210C,300C,497C 'patch':312C 'path':389C,544C 'place':379C 'plugin':118C,149C,334C,366C,412C,467C,488C,523C 'problem':132C,292C,404C,529C 'provid':204C,252C,345C 'r8z0p3mg':541C 'read':245C,413C 'recent':391C 'regist':115C,141C 'relat':543C 'releas':395C 'remov':363C 'request':463C 'respons':172C,190C,482C 'return':179C,471C 'rotat':351C 'run':337C 'scanner':536C,555C 'second':224C,310C 'secret':166C,196C,200C,248C,254C,258C,341C,347C,403C,528C 'sent':452C,479C 'server':114C,140C,165C,181C,265C,369C,402C,527C 'session':236C,270C,304C,498C,510C,519C 'sign':159C,170C,176C,212C,219C,242C,262C,377C,409C,415C,443C,448C,548C 'sign-in':169C,175C,211C,218C,376C,408C,447C,547C 'signatur':430C,432C 'skip':208C 'social':203C,251C,344C 'start':419C 'still':499C 'stop':515C 'store':489C 'summari':164C 'technic':405C 'temporari':496C 'transfer':416C,456C,462C 'treat':338C 'trust':266C 'turn':156C 'two':130C,154C,206C,290C,387C,485C 'two-factor':129C,153C,205C,289C,386C,484C 'twofactor':142C,146C,380C 'undo':356C 'upgrad':313C,353C,372C 'user':151C,239C,273C,298C,307C 'usual':189C 'valid':429C,461C 'valu':263C,426C,437C 'victim':280C 'vulner':538C,557C 'whatev':521C 'whole':473C 'whose':274C 'without':308C 'work':516C 'workaround':362C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T21:38:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-9p5w-h4pr-fcrc","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc","severity":"high","published_at":"2026-11-03T21:38:09+00:00","modified_at":"2026-11-04T03:17:10+00:00","first_seen_at":"2026-11-09T22:53:19+00:00","fetched_at":"2026-11-09T22:53:19+00:00","note":null}],"documents":[{"id":110495,"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}