# Better Auth v1.7.2

- Product: Better Auth (https://whatsnew.fyi/product/better-auth)
- Vendor: Better Auth
- Date: 2026-08-26
- Version: v1.7.2
- Original notes: https://github.com/better-auth/better-auth/releases/tag/v1.7.2
- Permalink: https://whatsnew.fyi/product/better-auth/releases/v1.7.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fixed permanent user bans to clear expiration dates from previous temporary bans
- **fixed** — Fixed client types with more plugins being assignable to types declaring fewer plugins
- **added** — Added warnings for invalid signed session data in the cookie cache
- **fixed** — Fixed disabled MyISAM indexes from satisfying migration index checks
- **fixed** — Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation
- **fixed** — Allowed ~ in relative callback URLs validated by trusted-origin checks
- **fixed** — Improved validation of relative callback and redirect URLs with paths, queries, and fragments
- **fixed** — Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins
- **changed** — Improved getTestInstance performance with a faster default password hasher
- **changed** — Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format
- **fixed** — Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions
- **fixed** — Fixed auth request logs to respect the configured logger, log level, and disabled setting
- **added** — Added synchronous and optional access to the current auth endpoint context
- **fixed** — Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server
- **fixed** — Fixed relative redirect URLs containing fragments
- **fixed** — Fixed one-to-one Drizzle relations when usePlural is enabled
- **added** — Added validation for missing Drizzle schema fields in compound where clauses

##### `better-auth`

###### Bug Fixes

- Fixed permanent user bans to clear expiration dates from previous temporary bans. ([#10823](https://github.com/better-auth/better-auth/pull/10823))
- Fixed client types with more plugins being assignable to types declaring fewer plugins. ([#10907](https://github.com/better-auth/better-auth/pull/10907))
- Added warnings for invalid signed session data in the cookie cache. ([#10934](https://github.com/better-auth/better-auth/pull/10934))
- Fixed disabled MyISAM indexes from satisfying migration index checks. ([#10877](https://github.com/better-auth/better-auth/pull/10877))
- Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. ([#10875](https://github.com/better-auth/better-auth/pull/10875))
- Allowed `~` in relative callback URLs validated by trusted-origin checks. ([#10041](https://github.com/better-auth/better-auth/pull/10041))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Allowed same-origin form submissions with `Referrer-Policy: no-referrer` while continuing to reject untrusted origins. ([#10959](https://github.com/better-auth/better-auth/pull/10959))
- Improved `getTestInstance` performance with a faster default password hasher. ([#10879](https://github.com/better-auth/better-auth/pull/10879))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/better-auth/CHANGELOG.md)

##### `@better-auth/core`

###### Bug Fixes

- Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. ([#10855](https://github.com/better-auth/better-auth/pull/10855))
- Fixed auth request logs to respect the configured logger, log level, and disabled setting. ([#10939](https://github.com/better-auth/better-auth/pull/10939))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Standardized built-in placeholder emails to the namespaced `{identifier}@{namespace}.placeholder.invalid` format. ([#10982](https://github.com/better-auth/better-auth/pull/10982))
- Added synchronous and optional access to the current auth endpoint context. ([#10938](https://github.com/better-auth/better-auth/pull/10938))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/core/CHANGELOG.md)

##### `@better-auth/oauth-provider`

###### Bug Fixes

- Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. ([#11010](https://github.com/better-auth/better-auth/pull/11010))
- Improved validation of relative callback and redirect URLs with paths, queries, and fragments. ([#10979](https://github.com/better-auth/better-auth/pull/10979))
- Fixed relative redirect URLs containing fragments. ([#10983](https://github.com/better-auth/better-auth/pull/10983))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/oauth-provider/CHANGELOG.md)

##### `@better-auth/drizzle-adapter`

###### Bug Fixes

- Fixed one-to-one Drizzle relations when `usePlural` is enabled. ([#10941](https://github.com/better-auth/better-auth/pull/10941))
- Added validation for missing Drizzle schema fields in compound `where` clauses. ([#10859](https://github.com/better-auth/better-auth/pull/10859))

For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/c50200bfc716cf43f5c29a2dd5766f6485c46aa1/packages/drizzle-adapter/CHANGELOG.md)

##### `@better-auth/kysely-adapter`

_[Truncated at 4000 characters — full notes: https://github.com/better-auth/better-auth/releases/tag/v1.7.2]_