Authentication Flaw in Better Auth Library for TypeScript
CVE-2026-114607
9.1CRITICAL
What is CVE-2026-114607?
The Better Auth library, versions between 1.4.0-beta.18 and 1.7.6, contains a vulnerability that allows an unauthenticated attacker to exploit settings related to Magic Link and OAuth providers. If configured with specific parameters such as storeToken set to plain or hashed, the global verification.storeIdentifier likewise set to hashed, and using account.storeStateStrategy set to database, attackers can initiate an OAuth sign-in process for a known email address. This can lead to the unauthorized assumption of user accounts and the ability to access sessions or create falsely verified accounts. The issue has been resolved in version 1.7.7.
Affected Version(s)
better-auth >= 1.4.0-beta.18, < 1.7.7