by Kastro
Paper/Archive/CVE-2026-110862

CVE-2026-110862

better-auth better-auth — Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
33
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 25.1.251 × 205.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

Affected

ProductAffectedFixed inSource
better-auth1.4.0-beta.18 – < 1.7.71.7.7CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jmwriteupvulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link