Live › vulnerability › CVE-2026-114607
Go to dashboardBetter Auth versions from 1.4.0-beta.18 through 1.7.7 let a Magic Link token be an OAuth sign-in state value under certain storage settings. An unauthenticated attacker can start OAuth sign-in for a known email, redeem the returned state as a Magic Link, and get a session for an existing user or an account marked email verified.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
npm ls better-auth affected if below 1.7.7Upgrade better-auth to 1.7.7 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-114607")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.