{"id":"CVE-2026-114607","published":"2026-10-22T17:16:58.577","lastModified":"2026-10-23T15:17:26.763","description":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a","tags":[]},{"url":"https://github.com/better-auth/better-auth/pull/11494","tags":[]},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","tags":[]},{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","tags":[]}],"exploitRefs":[{"url":"https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a","tags":[]},{"url":"https://github.com/better-auth/better-auth/pull/11494","tags":[]},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","tags":[]},{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","tags":[]}],"hasPoc":true,"ai":{"summary":"Better Auth versions before 1.7.7 allow an authentication bypass when Magic Link tokens and OAuth state values collide under specific misconfigured settings, letting an attacker impersonate a known user or create a pre-verified account without email control.","exploitability":"Exploitation requires the target to have enabled Magic Link with storeToken=plain (or storeToken=hashed + global storeIdentifier=hashed), a Generic OAuth provider configured, and account.storeStateStrategy set to database; under these conditions, an unauthenticated attacker can exploit it by initiating an OAuth flow and reusing the state as a Magic Link token.","blast_radius":"Successful exploitation grants full authenticated session access for any existing user or allows creation of an email-verified account, enabling account takeover or unauthorized sign-up with elevated trust.","remediation":"Upgrade to Better Auth version 1.7.7 or later, which fixes the token/state collision vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","oauth","magic-link","session-fixation","token-collision"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:52:02.678Z"}}