Bug fixes and SSO domain verification improvements
Fixed concurrent cold-start requests that could lose authentication context due to async storage race conditions, and improved SSO domain verification to require verified provider domains and prevent unauthorized organization assignment via social sign-in.
better-auth
Bug Fixes
- Fixed concurrent cold-start requests from intermittently losing authentication or transaction context due to an async storage initialization race (#10833)
For detailed changes, see CHANGELOG
@better-auth/sso
Bug Fixes
- Fixed automatic organization assignment via email domain to require both a verified provider domain and a verified stored user email, preventing social sign-in from joining an organization whose SSO provider merely claims that domain.
- Fixed domain verification to snapshot the provider's domains at request start, returning
409withSSO_PROVIDER_CHANGEDif the provider changes during DNS resolution so callers can reload and retry.
For detailed changes, see CHANGELOG
Contributors
Thanks to everyone who contributed to this release:
Full changelog: v1.6.29...v1.6.30
Source: original entry ↗
More from Better Auth
Follow Better Auth to get its new changes in your feed and email digest.
Magic Link upgrade and critical security fixes
Better Auth v1.7.7 addresses a critical Magic Link account-takeover vulnerability and multiple security issues including OAuth/SAML sign-in bugs and missing JSON headers in error responses. Magic Link requires a server upgrade with verification storage coordination, but no database migration is needed.
v1.7.6
Better Auth v1.7.6 adds support for customizable banned user messages and Vercel BotID captcha provider for authentication. This release fixes critical bugs including React hydration mismatches, password length validation, overlapping auth query requests, model identity issues across multiple adapters, and OAuth social account linking.
v1.7.5 Release
This release adds database schema name support for direct PostgreSQL connections and includes multiple bug fixes across better-auth packages, including improvements to server-side logging, database migrations, index validation, and adapter initialization.