OAuth state accepted as Magic Link token in Better Auth
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Better Auth from 1.4.0-beta.18 before 1.7.7 is affected. Under specific Magic Link and OAuth storage settings, the OAuth state is accepted as a Magic Link token (CWE-287). An unauthenticated attacker can start OAuth sign-in for a known email address and redeem the state as a Magic Link without access to the mailbox. This gives the attacker a session for an existing user, or an account marked email verified when sign-up is enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| better-auth | better-auth | 1.4.0-beta.18 to before 1.7.7 | 1.7.7 | Patch available | CNA |
| — | better-auth (npm) | 1.4.0-beta.18 to before 1.7.7 | 1.7.7 | Patch available | GHSA-965c-763c-88jm |
- better-auth Vendorbetter-auth Affected 1.4.0-beta.18 to before 1.7.7 Fixed in 1.7.7 Patch available CNA
- better-auth (npm) Vendor— Affected 1.4.0-beta.18 to before 1.7.7 Fixed in 1.7.7 Patch available GHSA-965c-763c-88jm
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* | — | — | better-auth |
- cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* Versions — — ·better-auth
Remediation
Update the better-auth npm package to version 1.7.7, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA better-auth (better-auth) Fixed in 1.7.7
- Fix · GHSA-965c-763c-88jm better-auth (npm) Fixed in 1.7.7 Advisory →
Timeline
- 2026-10-22 Threatist record created from CVE-2026-114607
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: LOW → MEDIUM
- 2026-10-27 Alias added: GHSA-965c-763c-88jm
References
Other 5
- https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
- https://github.com/better-auth/better-auth/pull/11494
- https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a
- https://github.com/better-auth/better-auth/releases/tag/v1.7.7
- https://github.com/better-auth/better-auth
More better-auth vulnerabilities
- TI-2025-38277 Better Auth: Unauthenticated API key creation through api-key plugin CVSS 4.0CRITICAL 9.3
- TI-2026-47627 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass CVSS 4.0HIGH 8.7
- TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
- TI-2026-13066 better-auth better-icons scan_project_icons/sync_icon path traversal CVSS 4.0MEDIUM 4.8
- TI-2026-74552 Authentication bypass in Better Auth Magic Link verification CVSS 4.0CRITICAL 9.3
- TI-2026-84923 Unchecked state signing in @better-auth/expo enables account takeover CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-114607 · CVE Program
- CVE-2026-114607 · NVD
- FIRST EPSS
- GHSA-965c-763c-88jm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences