All vulnerabilities
CVE-2026-114607GHSA-965c-763c-88jm

better-auth: OAuth state can be used as a Magic Link to sign in as another user

better-auth better-auth
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.7.7Fixed versionGitHub
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1.7.7better-auth, npmGitHubnpm install better-auth@1.7.7

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.

Text from CVE List

Affected versions 2

  • better-authaffected: >= 1.4.0-beta.18, < 1.7.7CVE List
  • better-auth, npm>= 1.4.0-beta.18, < 1.7.7GitHub

References 4