CVE-2026-114607: better-auth: OAuth state can be used as a Magic Link to sign in as another user
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.7.7
Event History
Frequently Asked Questions
How can I determine whether a deployment is exposed?
Check whether better-auth is in the affected range from 1.4.0-beta.18 until 1.7.7 and whether all of these conditions apply: Magic Link is enabled; storeToken is plain, or it is hashed with verification.storeIdentifier also hashed; a built-in social or Generic OAuth provider is enabled; and account.storeStateStrategy is database.
What does an attacker need to exploit this issue?
The attacker needs a known target email address and must be able to initiate an OAuth sign-in flow. They do not need to control the target mailbox or complete the OAuth provider callback.
What is the practical impact of successful exploitation?
An unauthenticated attacker can obtain a normal session for an existing user. If sign-up is enabled, they can instead create an account that is incorrectly marked as email verified.
What version contains the fix?
The issue is fixed in better-auth version 1.7.7.