v2.2.2

2.2.2 (2026-09-15)

Bug Fixes

• security: close the unverified-email account takeover on Better Auth 1.5 and 1.6 too (9b6f858)
• security: link a phone sign-in's fallback email to an existing user only when that user's accounts are the same number's deleted Firebase users (fb93dec)
• security: link an existing user by email only when that user's email is verified too, closing a pre-registration takeover (78f751e)
• security: re-parent an orphaned Firebase account row only to a user that already signs in with its UID or passes the email checks (368055a)
• security: reject unverified Firebase tokens that match an existing account by email — closes an account-takeover hole (2e8b7f0)
• security: stop @better-auth/sso and @better-auth/scim providers from claiming this plugin's Firebase account rows (3face3b)
• security: stop echoing internal errors in sign-in responses — only Firebase token and SDK failures map to 401 (a26f046)
• security: stop password sign-in from telling callers whether an email has a Firebase account (4ed0f41)
• security: stop send-password-reset from telling callers whether an email has a Firebase account (5e92a16)
• security: stop sign-in responses from echoing Firebase Admin's token verification errors (93796fa)
• security: stop the password reset code endpoints from echoing Firebase error text (1ac1f00)
• server: re-parent an orphaned Firebase account row on Better Auth 1.5 – 1.6 instead of adding a second row that Better Auth 1.7.3+ refuses (6bda816)
• server: return sign-in refusals with their own message instead of as "Firebase token verification failed" (161a21e)

Upgrade notes

Security. This release fixes an account takeover, GHSA-7wwq-rg44-9j5v. A Firebase ID token with an unverified email could sign in as, and link to, an existing Better Auth user with the same email. Every earlier version is affected, so upgrade.

Behavior changes

• A Firebase sign-in links to an existing user by email only when both the token's email and that user's email are verified. Users who signed up without verifying their email get 401 until they verify, unless you set account.accountLinking.requireLocalEmailVerified: false.

• The first sign-in that verifies a user's email ends that user's other sessions.

• A phone sign-in whose fallback email already belongs to a user links to that user only when all of its accounts are Firebase accounts for the same phone number whose Firebase users have been deleted. The check needs Firebase Admin credentials that can read users, scoped to the tenant for tenant tokens; otherwise the sign-in gets 401. If your getPhoneUserFallbackEmail builds the address from the phone number, delete the Better Auth user together with its Firebase user.

• @better-auth/sso providers and @better-auth/scim tokens can no longer use providerId firebase, or local:oauth:firebase as the issuer or SAML entity ID (422). Delete any such provider or token created earlier.

• Error responses no longer include Firebase's or the server's error text:

  • a failed token check returns 401 Firebase token verification failed;
  • a failed password sign-in returns 401 Firebase authentication failed;
  • any other server error returns 500;
  • sign-in refusals keep their own message.
  • send-password-reset returns the same response whether or not the email has an account, and the reset-code endpoints use fixed messages.

  The details go to Better Auth's logger. Update any client code that matched Firebase's messages.

• Turn on Firebase's email enumeration protection; see Password Reset.

Better Auth 1.7.3+ is supported. Every Firebase sign-in failed on Better Auth 1.7.3 and later, which went back to keying accounts by (providerId, accountId). No issuer backfill is needed on those versions. If your database ran Better Auth 1.7.0 – 1.7.2, or if earlier versions left duplicate Firebase account rows, follow the cleanup in Better Auth Compatibility before upgrading.