A high-severity authentication vulnerability in the better-auth TypeScript library could allow attackers to bypass security controls and manipulate user data.

The library suffers from improper authentication (CWE-287) and insufficient verification of data authenticity (CWE-345), allowing unauthenticated remote attackers to potentially compromise the integrity and confidentiality of the authentication process.

This vulnerability carries a CVSS score of 8.3, classifying it as high severity. Successful exploitation could lead to full account takeover or unauthorized access to sensitive application data, resulting in significant security breaches and potential regulatory non-compliance for organizations relying on this library for identity management.

Immediate Action: Update the better-auth dependency to version 1.6.11 or later immediately.

Proactive Monitoring: Review application access logs for unusual authentication patterns or unauthorized account modifications.

Compensating Controls: Implement strict network access controls and ensure that all authentication-related requests are validated against secondary security tokens or multi-factor authentication mechanisms.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the fundamental nature of the library, the risk of exploitation is significant. Security teams must prioritize updating to version 1.6.11 to ensure authentication integrity and prevent potential unauthorized access to their systems.