---
id: "GHSA-9p5w-h4pr-fcrc"
page: "https://infrastack.ai/live/GHSA-9p5w-h4pr-fcrc"
kind: "vulnerability"
aliases: ["GHSA-9p5w-h4pr-fcrc"]
title: "@better-auth/electron: Desktop sign-in can return the server secret and skip two-factor"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@better-auth/electron", "fixed": ["1.7.16"], "affected": ">= 1.5.0-beta.12, < 1.7.16", "ecosystem": "npm"}, {"name": "@better-auth/electron", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["authentication", "better-auth", "cwe-201", "cwe-288", "electron", "node", "package"]
not_affected_if: ["default-config", "no-electron-plugin"]
published_at: "2026-11-03T21:38:09+00:00"
first_seen_at: "2026-11-09T22:53:19+00:00"
updated_at: "2026-11-09T22:54:15+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc", "first_seen_at": "2026-11-09T22:53:19+00:00"}]
exploit_sources: []
---

# @better-auth/electron: Desktop sign-in can return the server secret and skip two-factor

Link for people: https://infrastack.ai/live/GHSA-9p5w-h4pr-fcrc (this .md is for agents)

The @better-auth/electron plugin can return Better Auth's internal server context, including the auth secret and social provider client secrets, in a normal sign-in response. A password sign-in can also create a desktop sign-in code before the second factor is checked, which can be exchanged for a full session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@better-auth/electron affected >= 1.5.0-beta.12, < 1.7.16 fixed 1.7.16
- npm:@better-auth/electron affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5

## How to check

- Check the installed version of `@better-auth/electron` and `better-auth` in your lockfile or with `npm ls @better-auth/electron`.
- Confirm whether your server registers `electron()` from `@better-auth/electron`.
- If you also use `twoFactor()`, check whether `electron()` appears before it in the `plugins` array.

## Fix

- `@better-auth/electron` and `better-auth`: `1.7.16` on the stable line
- `@better-auth/electron` and `better-auth`: `1.8.0-beta.5` on the beta line

## Timeline

- 2026-11-09T22:53:19+00:00 ghsa-repo https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-9p5w-h4pr-fcrc

## From the sources

## Am I affected?

You are affected if your server registers the `electron()` plugin from `@better-auth/electron` 1.5.0-beta.12 or later.

The two-factor problem below also needs all of these:

- The server registers `twoFactor()`.
- `electron()` appears before `twoFactor()` in the `plugins` array.
- Users with two-factor turned on can sign in with a password.

## Summary

**Server secret in the sign-in response.** A normal sign-in could return the server's internal auth context instead of the usual response. That context includes the auth secret and the client secrets of configured social providers.

**Two-factor skipped.** A password sign-in could create a desktop sign-in code before the second factor was checked. That code could be exchanged for a full session.

## Impact

Any user who can sign in can read the auth secret and the social provider client secrets. With the auth secret, they can create signed values the server trusts and get a session as another user whose email address they know. The victim does not need to do anything.

With the two-factor problem, an attacker who knows a user's password can get a session for that user without the second factor.

## Patches

Upgrade `@better-auth/electron` and `better-auth` to 1.7.16, or to 1.8.0-beta.5 on the beta line.

If the plugin has been running, treat the auth secret and every social provider client secret as disclosed, and rotate them. Upgrading does not undo a disclosure that already happened.

## Workarounds

Remove the `electron()` plugin from your server until you upgrade. This disables desktop sign-in.

Placing `twoFactor()` before `electron()` blocks the confirmed two-factor path on recent `better-auth` releases, but it does not fix the server secret problem.

## Technical details

After sign-in, the plugin reads a signed transfer cookie to start the desktop handoff. It accepted any value with a valid signature. A signature covers only the cookie value, not its name, so another signed cookie issued during sign-in could be sent back under the transfer cookie name. When no valid transfer request was found, the plugin's after hook returned the whole endpoint context, which Better Auth sent as the response.

For two-factor, the plugin stored the desktop authorization code while the temporary password session still existed. Desktop authorization codes are now bound to the browser session that issued them and stop working once that session ends, whatever the plugin order.

## Credit

The server secret problem was discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-R8Z0P3MG. A related path through anonymous sign-in was discovered by the same scanner, as vulnerability ANT-2026-DDHILQ2X.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_