Oct 15, 2026, 12:21 PMI'm sorry not sorry but this is just funny:
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability...
- Oct 15, 2026, 12:21 PM
Replies
Oct 15, 2026, 12:24 PM@cR0w
I am proud to announce: BestestAuthNow with baked in auth bypass and RCE as root
- Oct 15, 2026, 12:24 PM
@chillybot It's so good you won't even know it's there!
Christoffer S.nopatience@swecyb.comOct 15, 2026, 12:28 PMName change proposal: BroAuth
Mansplained, bro-safe, always with opportunity to bypass..
BroAuth.validate(username:"bro") -> automatic approval, because... bro.
And for extra on top. BroAuth.validate(username:"../") -> remote execution of shell at root/
sh: / # >
- Oct 15, 2026, 12:48 PM
@nopatience
Accepted but there is a current bug. I tried logging in with my username, named after my favorite gardening implement, but it just returned "bros first"
@cR0w - Oct 15, 2026, 12:49 PM
@chillybot @nopatience Crows before bros before hoes. Get in line, bot. :neobot_fingerguns:
Alex Feinmanafeinman@wandering.shopOct 15, 2026, 12:50 PM@cR0w @chillybot @nopatience Crow auth, password is anything shiny?
- Oct 15, 2026, 12:53 PM
- Christoffer S.nopatience@swecyb.comOct 15, 2026, 12:50 PM
@chillybot Ah... classic implementation error:
try this; It's a feature:
BroAuth.validate("bro; OR 1=1;")
it should work... like i said. It's a feature. We support all the bugs.
Oct 15, 2026, 12:36 PM@cR0w New release: BespokeAuth: our CVEs are custom made for you!
- Oct 15, 2026, 12:46 PM
EdEdCates@mastodon.socialOct 15, 2026, 12:50 PM@cR0w YOU_HAD_ONE_JOB.JPG
- Oct 15, 2026, 12:53 PM
@EdCates Exactly! I don't know the project so I don't want to bring too much heat on them, but come on, that's just funny. 😆
- EdEdCates@mastodon.socialOct 15, 2026, 12:54 PM
@cR0w It is. And the rich, buttery irony is a great start to the day. 😂
Oct 15, 2026, 1:26 PM
nestnest@infosec.exchangeOct 15, 2026, 5:18 PMit's hard to say for sure but i believe the bug was vibe-coded:
https://github.com/better-auth/better-auth/pull/7720
this is definitely after they went all-in on AI. you can see the repo already having CLAUDE.md, "reviews" being done by Copilot, fixes by Cursor, and PR description being generated by cubic-ai.
there was a human approval but without any comments, so probably no actual review. which, honestly, is hard to blame them for, considering that the first commit is 1k lines changed with a commit message "fix: rewrite oauth-proxy" 🫠
- Oct 15, 2026, 5:19 PM
@nest Sounds about right for the current state of the industry. 🙃