CVE-2026-110862: Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using npm/better-auth versions from 1.4.0-beta.18 up to, but not including, 1.7.7 are affected. The issue involves OAuth sign-in and Magic Link verification flows.
What does an attacker need to exploit this issue?
An attacker does not need to be authenticated or require user interaction. They can initiate an OAuth sign-in using a victim's email address and reuse the returned OAuth state value in Magic Link verification.
What is the potential impact of successful exploitation?
An attacker can obtain a session as another user. The flaw can also be used to create accounts that are falsely marked as email-verified.