Taesu and GitHub
23dbe1ad0e
fix: redirect hook rejections to errorCallbackURL across auth callback flows ( #9702 )
2026-05-22 00:14:48 +00:00
5190c2658f
fix: fail fast on unsafe MySQL insert returns ( #9665 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-05-21 22:14:04 +00:00
5626e1b437
fix: forward session cookie refresh headers ( #9667 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-21 20:17:19 +00:00
3f8f310a0f
fix(session): preserve real session expiry during stateless cache refresh ( #8817 )
...
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: cyphercodes <7407177+cyphercodes@users.noreply.github.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-21 20:12:04 +00:00
2d73ffff44
fix(core): respect dynamic baseURL protocol option in getTrustedOrigins ( #9644 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-05-19 19:27:09 +00:00
Gustavo Valverde and GitHub
e7eb45b065
feat(oauth): per-request additionalParams and loginHint ( #9305 )
2026-05-19 17:18:43 +00:00
Maxwell and GitHub
276d67fad5
fix: build synthetic user safely without including extra fields ( #9347 )
2026-05-19 17:17:54 +00:00
Maxwell and GitHub
9d91eb77f5
fix: getMigration field index order ( #9691 )
2026-05-19 16:42:19 +00:00
f77060af3a
fix: consumeVerificationValue returns null for expired rows ( #9624 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-19 16:37:55 +00:00
Taesu and GitHub
dcb2e6d29c
fix(cookies): percent-encode values on Cookie header serialize ( #9631 )
2026-05-19 16:35:44 +00:00
03e6c94e96
feat(generic-oauth,sso): support IDP-initiated flows via secure bounce ( #9301 )
...
Co-authored-by: Menachem Hornbacher <mhornbacher@kiddom.co >
2026-05-19 12:29:04 +00:00
f5e29eaf1e
fix(organization): wrap delete cascades in a transaction ( #9630 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-05-18 21:44:09 +00:00
Taesu and GitHub
a6f144ad0a
fix(client): decode escape sequences in parseJSON quoted strings ( #9617 )
2026-05-18 18:45:39 +00:00
Taesu and GitHub
1d372bbab9
fix(organization): reject invitation team ids containing a comma ( #9616 )
2026-05-18 18:41:32 +00:00
Taesu and GitHub
09a1d50a80
fix: tighten changeEmail config gate and encode callbackURL ( #9614 )
2026-05-18 18:40:45 +00:00
Taesu and GitHub
9bd53e191c
fix(access): reject empty action lists and continue "OR" evaluation on unknown resources ( #9603 )
2026-05-18 18:40:03 +00:00
602ec40293
feat(sso)!: support multiple IdP signing certificates ( #8805 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-18 03:07:37 +00:00
Gustavo Valverde and GitHub
e637c7d8ff
fix(deps): resolve dependabot security alerts ( #9662 )
2026-05-18 01:41:47 +00:00
Gustavo Valverde and GitHub
62dabf6678
fix: harden URL and Stripe escaping ( #9661 )
2026-05-17 21:25:32 +00:00
Gustavo Valverde and GitHub
1e5b808472
refactor(oauth): single-source Basic credentials + getHttpTestInstance ( #9657 )
2026-05-17 19:23:45 +00:00
c01b2f1321
fix(two-factor): delete session cookie cache on 2fa response ( #9639 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-17 16:40:50 +00:00
aebf66d8e6
feat: add token endpoint client authentication ( #9625 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-16 18:27:15 +00:00
Maxwell and GitHub
f5fcc9d37f
fix(admin): export AdminClientOptions and OrganizationClientOptions ( #9642 )
2026-05-16 02:46:57 +00:00
db4263cd3d
chore: use correct auth cli ( #9638 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-05-16 02:27:55 +00:00
Taesu and GitHub
160d132752
fix(kysely-adapter): report SQLite tables as non-views in introspector ( #9615 )
2026-05-16 00:18:06 +00:00
Taesu and GitHub
938efee305
fix(oauth-provider): preserve colons in Basic Auth client secret ( #9601 )
2026-05-15 15:48:59 +00:00
Taesu and GitHub
87f5a8fd27
fix(oauth-provider): return NOT_FOUND when consent update references a missing client ( #9600 )
2026-05-15 15:48:25 +00:00
1b40dac22e
fix(cookies): relax Cookie separator and centralize parsing ( #9543 )
...
Co-authored-by: sbougerel <5677149+sbougerel@users.noreply.github.com >
2026-05-14 15:59:39 +00:00
Maxwell and GitHub
ad9ad82496
fix(email-verification): clone request before passing to sendVerificationEmail callback ( #9619 )
2026-05-14 13:05:27 +00:00
Taesu and GitHub
7a120724c5
fix(captcha): exempt /sign-in/email-otp from captcha enforcement ( #9596 )
2026-05-12 23:59:38 +00:00
45d7cb8ad6
chore(deps): bump next from 16.2.3 to 16.2.6 ( #9580 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-12 23:44:51 +00:00
Maxwell and GitHub
6b44606b7d
fix(username): validate username on admin createUser endpoint ( #9464 )
2026-05-12 18:01:11 +00:00
better-release[bot] and GitHub
f41514ef07
chore: release v1.6.11 ( #9532 )
2026-05-12 17:30:34 +01:00
Gustavo Valverde and GitHub
699b09a206
fix(oidc-provider, mcp): drop "none" alg, default plain PKCE off, reject missing PKCE method ( #9575 )
2026-05-12 16:04:54 +00:00
b4bc65a007
Merge commit from fork
...
The `authorization_code` grant's verification step was a `findOne` + `deleteOne` pair, so two concurrent `POST /oauth2/token` requests sharing the same `code` both pass the find, both delete, and both mint independent access/refresh/id token sets: a CAS gap that lets an authorization code be redeemed twice. The legacy `oidc-provider` and `mcp` plugins in `better-auth` share the same primitive on their `authorization_code` paths and have the same gap.
All three call sites now use `internalAdapter.consumeVerificationValue` (the atomic primitive added in better-auth#9560 and renamed in better-auth#9568): the first concurrent caller receives the row and mints tokens, subsequent racers receive `null`. The consumed and expired paths return RFC 6749 §5.2 `invalid_grant` instead of the better-auth-internal `invalid_verification`, so spec-compliant clients can branch on the standard code. The redundant second `deleteVerificationByIdentifier` call after PKCE validation in the legacy paths is removed.
Closes GHSA-7w99-5wm4-3g79.
Co-authored-by: chdanielmueller <4051999+chdanielmueller@users.noreply.github.com >
2026-05-12 16:53:45 +01:00
c6918ecc9e
Merge commit from fork
...
The `authorization_code`-grant rotation in `createRefreshToken` and the explicit `revokeRefreshToken` path both updated the parent `oauthRefreshToken` row using an `id`-only predicate, so two concurrent rotations (or a rotation racing a revoke) both pass the `revoked` check and last-write-wins. Each surviving request mints a fresh refresh token, producing a forked family from one parent.
Both call sites now perform a compare-and-swap (`UPDATE ... WHERE id = ? AND revoked IS NULL`) and short-circuit with `invalid_grant` when the row was already consumed. The parent stays marked revoked, so any subsequent replay trips the existing family-invalidation guard in `handleRefreshTokenGrant`. The shared family-delete is centralized in `invalidateRefreshFamily`, which clears child access tokens before refresh rows to honor the schema's foreign-key direction; the `oauthRefreshToken.token` column also gains a `unique` constraint for parity with `oauthAccessToken.token`. Strict family invalidation on contested rotations (RFC 9700 §4.14) is tracked in a FIXME for a follow-up minor that opts into transactional rotation in the adapter contract.
Closes GHSA-392p-2q2v-4372.
Co-authored-by: chdanielmueller <4051999+chdanielmueller@users.noreply.github.com >
2026-05-12 16:36:32 +01:00
Gautam Manchandani and GitHub
a1c9f3c08e
fix(access): preserve exact role statement types ( #9507 )
...
Signed-off-by: Gautam Manchandani <manchandanigautam@gmail.com >
2026-05-12 15:17:44 +00:00
Maxwell and GitHub
b0ef96fd8e
fix: invalid instrumentation import list ( #9582 )
2026-05-12 15:03:15 +00:00
Gustavo Valverde and GitHub
da7e50beee
fix(oauth): block OAuth linking to unverified local accounts ( #9578 )
2026-05-12 14:20:19 +00:00
37f60cb176
fix(sso): validate user-supplied OIDC endpoint URLs at registration and update ( #9574 )
...
Co-authored-by: vaadata-poyetont <poyetont@vaadata.com >
2026-05-12 13:12:42 +00:00
Gustavo Valverde and GitHub
23094a628f
fix(organization): default-on requireEmailVerificationOnInvitation & extend gate to get/list ( #9577 )
2026-05-12 13:12:03 +00:00
Gustavo Valverde and GitHub
1f2ff4215c
fix(oidc-provider, mcp): authenticate confidential clients on refresh_token grant ( #9576 )
2026-05-12 13:09:27 +00:00
Gustavo Valverde and GitHub
5f09d566a6
fix(magic-link): consume verification token atomically on verify ( #9572 )
2026-05-12 12:50:38 +00:00
Gustavo Valverde and GitHub
2f5d91c5bb
fix(scim): reject built-in provider id collisions on SCIM token issuance ( #9579 )
2026-05-12 12:44:41 +00:00
Gustavo Valverde and GitHub
99a254a79b
fix(device-authorization): bind approval to verifier session ( #9573 )
2026-05-12 11:40:18 +00:00
Gautam Manchandani and GitHub
15bb1690b2
feat(cli): add create-admin command ( #9547 )
2026-05-12 10:30:04 +00:00
Taesu and GitHub
98e7e38867
test(stripe): restructure test suite with typed Stripe factories ( #9542 )
2026-05-12 08:06:52 +00:00
Gustavo Valverde and GitHub
0cbddb8fa4
refactor(db): rename claimOne adapter primitive to consumeOne ( #9568 )
2026-05-12 07:44:07 +00:00
Taesu and GitHub
62b8793c11
chore(deps): consolidate kysely into pnpm catalog ( #9569 )
2026-05-12 07:38:59 +00:00
3bec284c4f
chore(deps): bump kysely from 0.28.14 to 0.28.17 ( #9567 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-12 06:25:23 +00:00
TaesuandGitHub
Gustavo ValverdeandGitHub
better-release[bot]andGitHub
Gautam ManchandaniandGitHub
