better-auth: Admin roles with user:update can change another user's phone number

Am I affected?

You are affected if all of these are true:

• You use the admin plugin and the phone number plugin from better-auth.
• A role other than the full admin role holds the user:update permission.

You are not affected if only full administrators can update users.

Summary

The admin update-user endpoint requires a separate permission to change a user's email address, but not to change their phone number. A role allowed to edit user profiles could set another user's phone number and mark it as verified.

Impact

A user with a limited role that holds user:update can put their own phone number on another user's account and then sign in to that account with a phone OTP. This gives them the other user's session, including accounts with more privileges than their own.

Patches

Upgrade better-auth to 1.7.16, or to 1.8.0-beta.5 on the beta line.

Changing phoneNumber or phoneNumberVerified through now needs the new permission. The default admin role has it. If you use custom access control, add to your statements and grant it to the roles that should change phone numbers.