Authentication Bypass in Better Auth Product by Better Auth

CVE-2026-110862

What is CVE-2026-110862?

Better Auth versions prior to 1.7.7 are affected by an authentication bypass vulnerability. This flaw allows an unauthenticated attacker to impersonate legitimate users by reusing OAuth state values as Magic Link tokens. By initiating an OAuth sign-in with the victim's email, attackers can gain unauthorized access by submitting the returned state to Magic Link verification, enabling them to create falsified email-verified accounts or hijack user sessions. It is crucial for users of Better Auth to ensure they are on the latest version to mitigate this serious security risk.

References