CVE-2026-110864

7.4High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.4High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-287

Impact

Unauthenticated remote attackers can take over arbitrary user accounts via forged OAuth profiles. They need network access to the application using the OAuth Proxy plugin with cookie-stored state and a shared global secret.

Root cause

The OAuth Proxy plugin relies on a shared global secret and cookie-stored state, allowing attackers to forge encrypted state payloads that falsely verify a victim's email address during account linking.

Affected systems

Better Auth 1.5.0-beta.12 before 1.7.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade Better Auth to version 1.7.7 or higher. As an interim workaround, do not share the global secret with the OAuth proxy or avoid using cookie-stored state.

shell

$ npm install better-auth@^1.7.7

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110864