Better Auth API key plugin allows unauthorised access to user keys
A flaw in the Better Auth API key plugin allows attackers to create or modify keys without authentication, so developers using this plugin must upgrade.
What happened
A vulnerability in the Better Auth framework allows unauthenticated users to interact with the API key management system. Attackers can create new keys or modify existing ones because the plugin does not correctly verify permissions for these actions. This flaw exposes user accounts to unauthorised access through the manipulated keys.
Who is affected
Projects running better-auth versions between 1.2.0-beta.18 and 1.3.34 that have the apiKey plugin enabled are affected. Some intermediate versions attempted to fix key creation, although the ability to modify existing keys remained until the latest release. You are at risk if your application relies on this plugin for client authentication.
Why it matters if you build with AI
AI-driven development often involves connecting multiple services through API keys that your agent generates or manages. If these keys are compromised, an attacker could impersonate your users or access sensitive data stored within your AI workflows. Securing the authentication layer is essential to prevent unauthorised agents from interacting with your backend.
What to do
- Update better-auth to version 1.4.0 or later
- Review all API keys created while using affected versions
- Revoke any keys that appear suspicious or unrecognised
Locaas is being built to track advisories like this, check your running applications and propose the necessary updates for your approval.
Get early access