{"id":"CVE-2026-110862","published":"2026-10-14T23:17:27.673","lastModified":"2026-10-16T18:25:45.343","description":"Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","tags":[]},{"url":"https://www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link","tags":[]}],"exploitRefs":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to bypass authentication by reusing OAuth state values as Magic Link tokens, enabling them to sign in as any user without proper credentials. This creates a critical risk of unauthorized access and account takeover.","exploitability":"Exploitation is relatively straightforward requiring only the ability to initiate OAuth sign-in with a victim's email address and then reuse the returned state parameter, with no prerequisites for authentication or privileged access.","blast_radius":"The impact could be extensive as attackers can gain full session access or create falsely email-verified accounts for any user in the system, potentially leading to widespread unauthorized access and data compromise.","remediation":"Upgrade to Better Auth version 1.7.7 or later to address this authentication bypass vulnerability.","detection":"Monitor for unusual OAuth state parameter usage patterns in authentication logs, particularly when state parameters are reused across different user sessions or when Magic Link verification requests contain unexpected state values from previous OAuth flows.","tags":["auth-bypass","oauth","magic-link","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:57:29.762Z"}}