github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-18 11:32:15 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8832] Email Enumeration Protection Not Applied When autoSignIn is false and requireEmailVerification is false or unset #11207

New Issue
Open
opened 2026-04-13 07:33:16 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-13 07:33:16 -05:00
Owner
Copy Link
Copy Source

Originally created by @rkaiser-dev on GitHub (Mar 29, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8832

Originally assigned to: @ping-maxwell on GitHub.

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Create and configure betterAuth on server with emailAndPassword configured using autoSignIn: false and either requireEmailVerification: false or left unset.
  2. Sign up with an existing user.
  3. API Returns a 422.

Current vs. Expected behavior

Documentation states that email enumeration protection is enabled if requireEmailVerification: true is set OR autoSignIn: false is set. https://better-auth.com/docs/authentication/email-password#email-enumeration-protection

API Returns 422, I expected a 200 with a synthetic user.

What version of Better Auth are you using?

1.5.6

System info

Doesn't seem necessary to include this - see additional context.

Which area(s) are affected? (Select all that apply)

Backend, Documentation

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true,
    autoSignIn: false,
    requireEmailVerification: false, // or unset
  },
});

Additional context

It looks like this is probably the affected line of code. It is only checking for requireEmailVerification in this block where a user is found, rather than also considering autoSignIn. I've linked this for v1.5.6, but it looks like it's the same line in main currently.

https://github.com/better-auth/better-auth/blob/v1.5.6/packages/better-auth/src/api/routes/sign-up.ts#L251

Originally created by @rkaiser-dev on GitHub (Mar 29, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8832 Originally assigned to: @ping-maxwell on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Create and configure `betterAuth` on server with `emailAndPassword` configured using `autoSignIn: false` and either `requireEmailVerification: false` or left unset. 2. Sign up with an existing user. 3. API Returns a 422. ### Current vs. Expected behavior Documentation states that email enumeration protection is enabled if `requireEmailVerification: true` is set OR `autoSignIn: false` is set. https://better-auth.com/docs/authentication/email-password#email-enumeration-protection API Returns 422, I expected a 200 with a synthetic user. ### What version of Better Auth are you using? 1.5.6 ### System info ```bash Doesn't seem necessary to include this - see additional context. ``` ### Which area(s) are affected? (Select all that apply) Backend, Documentation ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true, autoSignIn: false, requireEmailVerification: false, // or unset }, }); ``` ### Additional context It looks like this is probably the affected line of code. It is only checking for `requireEmailVerification` in this block where a user is found, rather than also considering `autoSignIn`. I've linked this for v1.5.6, but it looks like it's the same line in `main` currently. https://github.com/better-auth/better-auth/blob/v1.5.6/packages/better-auth/src/api/routes/sign-up.ts#L251
GiteaMirror added the awaiting external contributorsecuritybug labels 2026-04-13 07:33:17 -05:00
GiteaMirror commented 2026-04-13 07:33:18 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Mar 29, 2026):

Hi @rkaiser-dev! I'm Dosu and I’m helping the better-auth team.

This does appear to be a bug. The documentation states email enumeration protection is enabled when either requireEmailVerification: true or autoSignIn: false is set , but the code only checks requireEmailVerification.

The issue is at line 235 in packages/better-auth/src/api/routes/sign-up.ts [1]:

const shouldReturnGenericDuplicateResponse =
    ctx.context.options.emailAndPassword.requireEmailVerification;

This should also check autoSignIn === false:

const shouldReturnGenericDuplicateResponse =
    ctx.context.options.emailAndPassword.requireEmailVerification ||
    ctx.context.options.emailAndPassword.autoSignIn === false;

The autoSignIn setting is used separately to control whether a session token is returned, but it does not trigger the synthetic user response that provides enumeration protection. So when you set autoSignIn: false without requireEmailVerification: true, the code falls through to the error path at line 313-316 which throws the 422 [2].

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:4151112999 --> @dosubot[bot] commented on GitHub (Mar 29, 2026): <!-- Greeting --> Hi @rkaiser-dev! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> This does appear to be a bug. The documentation states email enumeration protection is enabled when **either** `requireEmailVerification: true` **or** `autoSignIn: false` is set , but the code only checks `requireEmailVerification`. The issue is at line 235 in `packages/better-auth/src/api/routes/sign-up.ts` [[1]](https://github.com/better-auth/better-auth/blob/03d2df66030ba7c020024d3fb4147a5cf9650192/packages/better-auth/src/api/routes/sign-up.ts#L235): ```typescript const shouldReturnGenericDuplicateResponse = ctx.context.options.emailAndPassword.requireEmailVerification; ``` This should also check `autoSignIn === false`: ```typescript const shouldReturnGenericDuplicateResponse = ctx.context.options.emailAndPassword.requireEmailVerification || ctx.context.options.emailAndPassword.autoSignIn === false; ``` The `autoSignIn` setting is used separately to control whether a session token is returned, but it does not trigger the synthetic user response that provides enumeration protection. So when you set `autoSignIn: false` without `requireEmailVerification: true`, the code falls through to the error path at line 313-316 which throws the 422 [[2]](https://github.com/better-auth/better-auth/blob/03d2df66030ba7c020024d3fb4147a5cf9650192/packages/better-auth/src/api/routes/sign-up.ts#L313-L316). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=great_response&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=irrelevant_answer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=incorrect_sources&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=too_verbose&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=hallucination&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=bug_report&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report) | [Other](https://app.dosu.dev/response-feedback/5fcbc19d-7eb1-4a70-bb10-eb71aa078f87?feedback_type=other&utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20does%20appear%20to%20be%20a%20bug.%20The%20documentation%20states%20email%20enumeration%20protection%20is%20enabled%20when%20%2A%2Aeither%2A%2A%20%60requireEmailVerification%3A%20true%60%20%2A%2Aor%2A%2A%20%60autoSignIn%3A%20false%60%20is%20set%20%2C%20but%20the%20code%20only%20checks%20%60requireEmailVerification%60.%0A%0AThe%20issue%20is%20at%20line%20235%20in%20%60packages/better-auth/src/api/routes/sign-up.ts%60%20%5B%5B1%5D%5D%28https%3A//github.com/better-auth/better-auth/blob/03d2df66030ba7c020024d3fb4147a5cf9650192/packages/better-auth/src/api/routes/sign-up.ts%23L235%29%3A%0A%0A%60%60%60typescript%0Aconst%20shouldReturnGenericDuplicateResponse%20%3D%0A%20%20%20%20ctx.context.options.emailAndPassword.requireEmailVerification%3B%0A%60%60%60%0A%0AThis%20should%20also%20check%20%60autoSignIn%20%3D%3D%3D%20false%60%3A%0A%0A%60%60%60typescript%0Aconst%20shouldReturnGenericDuplicateResponse%20%3D%0A%20%20%20%20ctx.context.options.emailAndPassword.requireEmailVerification%20%7C%7C%0A%20%20%20%20ctx.context.options.emailAndPassword.autoSignIn%20%3D%3D%3D%20false%3B%0A%60%60%60%0A%0AThe%20%60autoSignIn%60%20setting%20is%20used%20separately%20to%20control%20whether%20a%20session%20token%20is%20returned%2C%20but%20it%20does%20not%20trigger%20the%20synthetic%20user%20response%20that%20provides%20enumeration%20protection.%20So%20when%20you%20set%20%60autoSignIn%3A%20false%60%20without%20%60requireEmailVerification%3A%20true%60%2C%20the%20code%20falls%20through%20to%20the%20error%20path%20at%20line%20313-316%20which%20throws%20the%20422%20%5B%5B2%5D%5D%28https%3A//github.com/better-auth/better-auth/blob/03d2df66030ba7c020024d3fb4147a5cf9650192/packages/better-auth/src/api/routes/sign-up.ts%23L313-L316%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8832)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels awaiting external contributor bug security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#11207