---
id: "GHSA-g95c-wqvr-8c3j"
page: "https://infrastack.ai/live/GHSA-g95c-wqvr-8c3j"
kind: "vulnerability"
aliases: ["GHSA-g95c-wqvr-8c3j"]
title: "better-auth: Admin roles with user:update can change another user's phone number"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "better-auth", "fixed": ["1.7.16"], "affected": "< 1.7.16", "ecosystem": "npm"}, {"name": "better-auth", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["auth", "better-auth", "cwe-863", "node", "package", "self-hosted"]
not_affected_if: ["admin-plugin-disabled", "only-full-admin-can-update-users", "phone-plugin-disabled"]
published_at: "2026-11-03T22:07:18+00:00"
first_seen_at: "2026-11-09T22:53:20+00:00"
updated_at: "2026-11-09T22:54:37+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j", "first_seen_at": "2026-11-09T22:53:20+00:00"}]
exploit_sources: []
---

# better-auth: Admin roles with user:update can change another user's phone number

Link for people: https://infrastack.ai/live/GHSA-g95c-wqvr-8c3j (this .md is for agents)

A role that holds the user:update permission in the better-auth admin plugin can set another user's phone number and mark it verified. The attacker can then sign in to that account with a phone OTP and take over its session, including accounts with more privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:better-auth affected < 1.7.16 fixed 1.7.16
- npm:better-auth affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5

## How to check

- Check the installed version with `npm ls better-auth`.
- Check whether the admin plugin and the phone number plugin are both enabled in your better-auth configuration.
- Check whether any custom role other than the full admin role holds `user:update`.

## Fix

- Upgrade `better-auth` to `1.7.16` on the 1.7 line.
- Upgrade `better-auth` to `1.8.0-beta.5` on the beta line.

## Timeline

- 2026-11-09T22:53:20+00:00 ghsa-repo https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-g95c-wqvr-8c3j

## From the sources

## Am I affected?

You are affected if **all** of these are true:

- You use the admin plugin and the phone number plugin from `better-auth`.
- A role other than the full admin role holds the `user:update` permission.

You are not affected if only full administrators can update users.

## Summary

The admin `update-user` endpoint requires a separate permission to change a user's email address, but not to change their phone number. A role allowed to edit user profiles could set another user's phone number and mark it as verified.

## Impact

A user with a limited role that holds `user:update` can put their own phone number on another user's account and then sign in to that account with a phone OTP. This gives them the other user's session, including accounts with more privileges than their own.

## Patches

Upgrade `better-auth` to 1.7.16, or to 1.8.0-beta.5 on the beta line.

Changing `phoneNumber` or `phoneNumberVerified` through `update-user` now needs the new `user:set-phone` permission. The default admin role has it. If you use custom access control, add `set-phone` to your statements and grant it to the roles that should change phone numbers.

## Workarounds

Remove `user:update` from roles that should not change sign-in details, or reject `phoneNumber` and `phoneNumberVerified` in requests to `/admin/update-user` before they reach Better Auth.

## Technical details

`/admin/update-user` checked `user:set-email` before changing the email address, but passed phone fields through with only `user:update`. It now checks `user:set-phone` when either phone field is present.

## Credit

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-938BEJ5J.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_