Better-auth: OAuth Proxy Lets An Attacker Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated "secret", or its "secret" equals...

Better-auth: OAuth State Can Be Used As A Magic Link To Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from "1.4.0-beta.18" through versions before "1.7.7" with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default "storeToken: "plain"", or with...

better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that...

GHSA-965C-763C-88JM better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation of verification records across different authentication flows. Because magic-link tokens and OAuth state...

CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in...

CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in...

CVE-2026-114607

The better-auth authentication and authorization library for TypeScript (versions 1.4.0-beta.18 to 1.7.7 ) contains a vulnerability where an OAuth sign-in state can be misused as a Magic Link token. This occurs when specific configurations are met: Magic Link is enabled with storeToken set to pla...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation between verification record types, allowing an attacker to substitute a token issued for one authenticatio...