github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

⚠️ Security: Verified phoneNumber should not be directly modifiable via updateUser() #2210

New Issue
Closed
opened 2026-03-13 09:34:49 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-03-13 09:34:49 -05:00
Owner
Copy Link

Originally created by @ghyath5 on GitHub (Oct 26, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I am using phone number plugin, it adds phoneNumber and phoneNumberVerified fields

However if the user has a verified phoneNumber and tried to modify his PhoneNumber directly using authClient.updateUser he would be able to pass phoneNumber and modify it directly and the phoneNumberVerified value would keep true as verified

I have noticed this lately and I stripped the phoneNumber in database hook in before user creation

I believe this should be done in a different way, even to force phoneNumberVerified to be set to false whenever the user changes his phone directly or to omit the phoneNumber from being updatable fields in user schema.

Current vs. Expected behavior

I expected to even update phoneNumberaverified to false after updating the phoneNumber or to never allow phoneNumber from being modified by user directly

What version of Better Auth are you using?

Latest

System info

*

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @ghyath5 on GitHub (Oct 26, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce I am using phone number plugin, it adds phoneNumber and phoneNumberVerified fields However if the user has a verified phoneNumber and tried to modify his PhoneNumber directly using `authClient.updateUser` he would be able to pass `phoneNumber` and modify it directly and the `phoneNumberVerified` value would keep true as verified I have noticed this lately and I stripped the phoneNumber in database hook in before user creation I believe this should be done in a different way, even to force phoneNumberVerified to be set to false whenever the user changes his phone directly or to omit the phoneNumber from being updatable fields in user schema. ### Current vs. Expected behavior I expected to even update phoneNumberaverified to false after updating the phoneNumber or to never allow phoneNumber from being modified by user directly ### What version of Better Auth are you using? Latest ### System info ```bash * ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the enhancement label 2026-03-13 09:34:49 -05:00
GiteaMirror commented 2026-03-13 09:34:51 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Oct 26, 2025):

Hi @ghyath5! I'm Dosu and I’m helping the better-auth team.

There is currently no built-in restriction in Better Auth to prevent users from directly modifying the phoneNumber field via updateUser, nor is there automatic logic to reset phoneNumberVerified to false when the phone number changes outside the verification flow. The phoneNumberVerified field is marked as input: false in the plugin schema, but this does not prevent updates through updateUser or similar backend calls. This means your workaround using database hooks is necessary for now, as the framework itself does not enforce these constraints out of the box. For robust security, you should continue to use hooks (like beforeUpdate) to strip or validate phoneNumber changes and reset phoneNumberVerified as needed. This is a known gap in the current plugin logic and has been discussed in related issues and code reviews, but is not yet addressed at the framework level reference.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 26, 2025): <!-- Greeting --> Hi @ghyath5! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> There is currently no built-in restriction in Better Auth to prevent users from directly modifying the phoneNumber field via updateUser, nor is there automatic logic to reset phoneNumberVerified to false when the phone number changes outside the verification flow. The phoneNumberVerified field is marked as input: false in the plugin schema, but this does not prevent updates through updateUser or similar backend calls. This means your workaround using database hooks is necessary for now, as the framework itself does not enforce these constraints out of the box. For robust security, you should continue to use hooks (like beforeUpdate) to strip or validate phoneNumber changes and reset phoneNumberVerified as needed. This is a known gap in the current plugin logic and has been discussed in related issues and code reviews, but is not yet addressed at the framework level [reference](https://github.com/better-auth/better-auth/blob/56cd2083bf18d5bf3f737fcb564ef69f3b864e7b/packages/better-auth/src/plugins/phone-number/index.ts). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/953bd3c0-e360-4f97-9e4a-936ae548b54a?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5597)
GiteaMirror commented 2026-03-13 09:34:52 -05:00
Author
Owner
Copy Link

@ghyath5 commented on GitHub (Oct 27, 2025):

@dosu I understand, but this is critical and it should be resolved as soon as possible or at least to be explicitly mentioned in the documentation in phoneNumber plugin page

@ghyath5 commented on GitHub (Oct 27, 2025): @dosu I understand, but this is critical and it should be resolved as soon as possible or at least to be explicitly mentioned in the documentation in phoneNumber plugin page
GiteaMirror commented 2026-03-13 09:34:53 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Oct 27, 2025):

You're right—this is a critical security gap. There is currently no built-in restriction in Better Auth to prevent direct modification of phoneNumber via updateUser, nor is there automatic logic to reset phoneNumberVerified to false when the phone number changes outside the verification flow. This limitation is not documented in the phoneNumber plugin docs, and workarounds like database hooks are necessary for now plugin code updateUser endpoint.

This should be explicitly mentioned in the documentation for the phoneNumber plugin until a framework-level fix is available. For now, it's best to continue using hooks or custom logic to enforce this constraint and reset phoneNumberVerified as needed. I recommend maintainers prioritize either a framework fix or a documentation update to warn users about this issue.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 27, 2025): <!-- Answer --> You're right—this is a critical security gap. There is currently no built-in restriction in Better Auth to prevent direct modification of phoneNumber via updateUser, nor is there automatic logic to reset phoneNumberVerified to false when the phone number changes outside the verification flow. This limitation is not documented in the phoneNumber plugin docs, and workarounds like database hooks are necessary for now [plugin code](https://github.com/better-auth/better-auth/blob/97cd4a205957002568915b2f8b85c2b9c8de76d9/packages/better-auth/src/plugins/phone-number/index.ts) [updateUser endpoint](https://github.com/better-auth/better-auth/blob/97cd4a205957002568915b2f8b85c2b9c8de76d9/packages/better-auth/src/api/routes/update-user.ts). This should be explicitly mentioned in the documentation for the phoneNumber plugin until a framework-level fix is available. For now, it's best to continue using hooks or custom logic to enforce this constraint and reset phoneNumberVerified as needed. I recommend maintainers prioritize either a framework fix or a documentation update to warn users about this issue. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/410f7114-37f9-44a4-b743-a24f99e3f2ec?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5597)
GiteaMirror commented 2026-03-13 09:34:53 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Oct 28, 2025):

If you actually found a security issue, please send a security report on security@better-auth.com instead

@Bekacru commented on GitHub (Oct 28, 2025): If you actually found a security issue, please send a security report on security@better-auth.com instead
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2210
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?