{"id":"CVE-2026-114607","kind":"vulnerability","aliases":["CVE-2026-114607"],"related":[],"title":"Better Auth: Magic Link accepts OAuth state, giving attacker existing user sessions","description":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.","summary":"Better Auth versions from 1.4.0-beta.18 through 1.7.7 let a Magic Link token be an OAuth sign-in state value under certain storage settings. An unauthenticated attacker can start OAuth sign-in for a known email, redeem the returned state as a Magic Link, and get a session for an existing user or an account marked email verified.","severity":"critical","cvss":9.1,"epss":0.00347,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["better-auth","node","package","typescript"],"not_affected_if":["magic-link-disabled","no-social-or-generic-oauth-provider","storestatestrategy-not-database","version-1.7.7-or-later"],"how_to_check":"Check the installed better-auth version (for example, npm ls better-auth); affected if below 1.7.7. Look for magicLink with storeToken set to plain, or hashed with verification.storeIdentifier set to hashed, plus a social or Generic OAuth provider and account.storeStateStrategy set to database.","fix":"Upgrade better-auth to 1.7.7 or later.","status":"open","published_at":"2026-10-22T17:16:58+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:23+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:32:23Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade better-auth to 1.7.7 or later.","reach":"internet","title":"Better Auth: Magic Link accepts OAuth state, giving attacker existing user sessions","impact":"high","summary":"Better Auth versions from 1.4.0-beta.18 through 1.7.7 let a Magic Link token be an OAuth sign-in state value under certain storage settings. An unauthenticated attacker can start OAuth sign-in for a known email, redeem the returned state as a Magic Link, and get a session for an existing user or an account marked email verified.","category":"package","who_cares":["better-auth","typescript","node"],"confidence":0.8,"needs_auth":"no","worst_case":"attacker takes over existing user accounts without mailbox access","analyst_note":"","how_to_check":"Check the installed better-auth version (for example, npm ls better-auth); affected if below 1.7.7. Look for magicLink with storeToken set to plain, or hashed with verification.storeIdentifier set to hashed, plus a social or Generic OAuth provider and account.storeStateStrategy set to database.","needs_analyst":false,"not_affected_if":["magic-link-disabled","no-social-or-generic-oauth-provider","storeStateStrategy-not-database","version-1.7.7-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000898,"input_tokens":3111,"output_tokens":1173,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114607':15A,18A '-2026':14A,17A '1.4.0':29B,96C '1.7.7':32B,99C,237C 'accept':5A,142C 'account':81B,219C 'account.storestatestrategy':137C 'address':187C 'allow':173C 'also':121C 'attack':9A,52B,176C,206C 'auth':2A,21B,26B,86C 'authent':89C 'author':91C 'beta.18':30B,97C 'better':1A,20B,25B,85C 'better-auth':19B 'built':128C 'built-in':127C 'callback':204C 'caus':158C 'certain':47B 'complet':201C 'control':197C 'creat':217C 'cve':13A,16A 'databas':140C 'deploy':100C 'email':62B,83B,186C,223C 'enabl':102C,125C,230C 'exist':10A,77B,214C 'fix':234C 'generic':132C 'get':72B 'give':8A 'global':118C 'hash':115C,124C 'identifi':172C 'incorrect':220C 'issu':232C 'known':61B,185C 'let':33B 'librari':92C 'link':4A,36B,70B,104C,153C,160C,195C 'magic':3A,35B,69B,103C,152C,159C,194C 'mailbox':199C 'mark':82B,221C 'node':22B 'normal':210C 'oauth':6A,40B,55B,133C,144C,164C,179C 'obtain':208C 'packag':23B 'plain':109C 'provid':134C,203C 'record':162C 'redeem':63B,189C 'resolv':167C 'return':65B,191C 'session':12A,74B,211C 'set':49B,107C,113C,120C,122C,138C,156C 'sign':42B,57B,146C,181C,227C 'sign-in':41B,56B,145C,180C 'sign-up':226C 'social':130C 'start':54B,178C 'state':7A,44B,66B,148C,165C,192C 'storag':48B 'store':171C 'storetoken':106C,112C 'token':37B,154C 'typescript':24B,94C 'unauthent':51B,175C 'use':136C 'user':11A,78B,215C 'valu':45B,149C 'verif':161C 'verifi':84B,224C 'verification.storeidentifier':119C 'version':27B,236C 'without':196C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T17:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114607","severity":null,"published_at":"2026-10-22T17:16:58+00:00","modified_at":"2026-10-23T15:17:26+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114607","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114607","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}