github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #749] Bug: User with empty email can be created using email OTP. Input validation is probably not performed. #17040

New Issue
Closed
opened 2026-04-15 14:59:05 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 14:59:05 -05:00
Owner
Copy Link

Originally created by @JosipPardon on GitHub (Dec 3, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/749

Describe the bug
User with empty email can be created using OTP. Input validation is probably not performed. authClient.emailOtp.sendVerificationOtp and authClient.emailOtp.sendVerificationOtp are problematic.

To Reproduce

auth-client.ts:
import { createAuthClient } from "better-auth/react";
import { emailOTPClient } from "better-auth/client/plugins";
export const authClient = createAuthClient({
  plugins: [emailOTPClient()],
});

auth.ts:
const prisma = new PrismaClient();
export const auth = betterAuth({
  database: prismaAdapter(prisma, {
    provider: "mysql",
  }),

  emailAndPassword: {
    enabled: false,
  },

  plugins: [
    emailOTP({
      async sendVerificationOTP({ email, otp, type }) {
        console.log(`Your OTP is ${otp}`); // for testing purposes
      }
    }),
  ],
});

page.tsx:
const [code, setCode] = useState("");
const [email, setEmail] = useState("");
const [codeSent, setCodeSent] = useState(false);
<button
  onClick={async () => {
    await authClient.emailOtp.sendVerificationOtp(
      {
        email: email,
        type: "sign-in", // or "email-verification"
      },
      {
        onSuccess: (ctx) => {
          setCodeSent(true);
        },
      }
    );
  }}
>
  sign in / sign up
</button>

and then: 
<input
  type="text"
  value={code}
  onChange={(e) => setCode(e.target.value)}
/>
<button
  onClick={async () => {
    const user = await authClient.signIn.emailOtp({
      email: email,
      otp: code,
    });
  }}
>
  confirm code
</button>

Expected behavior
When empty email is passed as input, user should not be created nor logged it. authClient.emailOtp.sendVerificationOtp should result in error, as well as authClient.signIn.emailOtp.

Originally created by @JosipPardon on GitHub (Dec 3, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/749 **Describe the bug** User with empty email can be created using OTP. Input validation is probably not performed. `authClient.emailOtp.sendVerificationOtp` and `authClient.emailOtp.sendVerificationOtp` are problematic. **To Reproduce** ``` auth-client.ts: import { createAuthClient } from "better-auth/react"; import { emailOTPClient } from "better-auth/client/plugins"; export const authClient = createAuthClient({ plugins: [emailOTPClient()], }); auth.ts: const prisma = new PrismaClient(); export const auth = betterAuth({ database: prismaAdapter(prisma, { provider: "mysql", }), emailAndPassword: { enabled: false, }, plugins: [ emailOTP({ async sendVerificationOTP({ email, otp, type }) { console.log(`Your OTP is ${otp}`); // for testing purposes } }), ], }); page.tsx: const [code, setCode] = useState(""); const [email, setEmail] = useState(""); const [codeSent, setCodeSent] = useState(false); <button onClick={async () => { await authClient.emailOtp.sendVerificationOtp( { email: email, type: "sign-in", // or "email-verification" }, { onSuccess: (ctx) => { setCodeSent(true); }, } ); }} > sign in / sign up </button> and then: <input type="text" value={code} onChange={(e) => setCode(e.target.value)} /> <button onClick={async () => { const user = await authClient.signIn.emailOtp({ email: email, otp: code, }); }} > confirm code </button> ``` **Expected behavior** When empty email is passed as input, user should not be created nor logged it. `authClient.emailOtp.sendVerificationOtp` should result in error, as well as `authClient.signIn.emailOtp`.
GiteaMirror added the locked label 2026-04-15 14:59:05 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#17040
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?