listMembers throws "Incorrect syntax near ')'" on MSSQL when the filter matches zero members
Is this suited for github?
- Yes, this is suited for github
Reproduction
Reproduction
- Create an organization with at least one member
- Call listMembers with a filter matching zero rows — e.g. filterField: 'role', filterValue: 'admin' on an org that has only owners and members
Any filter matching zero rows reproduces it; role is just the easiest to hit.
Current vs. Expected behavior
What happens
Calling auth.api.listMembers with a filter that matches no members throws a SQL syntax error instead of returning an empty list:
Error: Incorrect syntax near ')'.Cause
In packages/better-auth/src/plugins/organization/adapter.ts, listMembers fetches member rows and then looks up the corresponding users:
const users = await adapter.findMany<User>({
model: "user",
where: [{ field: "id", value: members[0].map((member) => member.userId), operator: "in" }],
limit: members[0].length,
});When the member query returns nothing, the in value is an empty array and the adapter emits IN (). SQL Server rejects that as a syntax error. Postgres and MySQL tolerate it, which is likely why it hasn't surfaced on other dialects.
limit: members[0].length also evaluates to 0 in this case, which some dialects reject independently.
Expected
{ members: [], total: }
Suggested fix
Return early when the member query is empty, before the user lookup. This also avoids an unnecessary query on empty pages.
Note
The admin plugin's listUsers is unaffected — it queries a single table, so no id list is interpolated. The issue is specific to the two-step member → user fetch here, and would apply anywhere else that pattern occurs.
What version of Better Auth are you using?
System info
{
"system": {
"platform": "linux",
"arch": "x64",
"version": "#136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 1 21:53:05 UTC 2026",
"release": "6.8.0-136-generic",
"cpuCount": 8,
"cpuModel": "Intel(R) Core(TM) i7-4785T CPU @ 2.20GHz",
"totalMemory": "15.52 GB",
"freeMemory": "2.81 GB"
},
"node": {
"version": "v24.18.0",
"env": "development"
},
"packageManager": {
"name": "npm",
"version": "12.0.1"
},
"frameworks": null,
"databases": null,
"betterAuth": {
"version": "Unknown",
"config": null
}
}Which area(s) are affected? (Select all that apply)
Backend, Client, Package
Auth config (if applicable)
import { betterAuth } from "better-auth"
export const auth = betterAuth({
emailAndPassword: {
enabled: true
},
});Additional context
No response
Source: better-auth/better-auth