CVE-2026-110864: Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Better Auth versions from 1.5.0-beta.12 through versions before 1.7.7 are affected if they use the OAuth Proxy plugin, the proxy shares the global secret, and OAuth state is stored in cookies.
What does an attacker need to exploit the vulnerability?
An attacker does not need to authenticate or interact with a user. They need the affected OAuth Proxy configuration so they can obtain encrypted state for a forged profile containing a victim's verified email address.
What is the impact if exploitation succeeds?
An attacker can sign in as another user and take over that user's account through implicit linking. The reported impact includes high confidentiality and integrity effects, with no availability impact indicated.