CVE-2026-110862
9.1CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Unauthenticated remote attackers can hijack existing user sessions or forge verified accounts using a victim's email address. They only need network access to start an OAuth flow and submit the resulting state token to the Magic Link verification endpoint.
Root cause
The application accepts OAuth state parameters as valid tokens for Magic Link verification without differentiating token types or contexts.
Affected systems
Better Auth from 1.4.0-beta.18 before 1.7.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Better Auth to version 1.7.7 or later. If upgrading immediately is not possible, disable the Magic Link authentication plugin or provider until patched.
$ npm install better-auth@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.