Better Auth: Authentication bypass via OAuth state reused as Magic Link token

Summary

Better Auth versions from 1.4.0-beta.18 before 1.7.7 accept an OAuth sign-in state value as a Magic Link token. An unauthenticated attacker who knows a user's email address can start an OAuth sign-in for that address and use the returned state to sign in as that user, without access to the mailbox. If Magic Link sign-up is enabled, the attacker can also create accounts that are wrongly marked as email verified. The issue applies only when Magic Link is combined with social or Generic OAuth sign-in. Some trackers list this issue as CVE-2026-114607; the mapping is still to be confirmed.

Affected

• Better Auth (npm package better-auth) from 1.4.0-beta.18 before 1.7.7
• Relevant only if the Magic Link plugin is enabled together with social or Generic OAuth sign-in and OAuth state is stored in the database (account.storeStateStrategy set to database, the default when a database or secondary storage is configured)

Fixed in

• Upgrade to better-auth 1.7.7 or later
• Downstream projects use later 1.7.x releases (1.7.14 is mentioned); verify the current release on npm before choosing a target version
• Keep Better Auth adapters, plugins and integrations on the same release version

Workaround

• Set account.storeStateStrategy to cookie (unverified third-party suggestion; not confirmed by the vendor)
• Set the Magic Link option storeToken to hashed and leave global verification.storeIdentifier unset or plain (unverified third-party suggestion)
• Turn off Magic Link sign-in, or turn off social and Generic OAuth sign-in (vendor-listed option)
• Setting disableSignUp on the Magic Link plugin is not sufficient

Exploitation

• Exploitation in the wild: Unknown
• Public proof of concept: none found in research; CISA KEV not checked
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total

Our recommendation

• Check the installed better-auth version in all lockfiles and deployments and upgrade to 1.7.7 or later
• After upgrading, invalidate existing sessions and request new Magic Links; restart pending OAuth and account-linking flows
• Review accounts created through Magic Link sign-up around the exposure period for unexpected or falsely verified accounts
• Update any custom verification identifier override rules to match the new prefixes
• If patching is delayed, apply one of the workarounds or disable Magic Link or social login
• Treat internet-facing web applications built on Better Auth as urgent; off-the-shelf software is unlikely to be affected

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-965c-763c-88jm github.com
• VulnCheck Advisory: Better Auth Authentication Bypass via Magic Link www.vulncheck.com
• OSV: GHSA-965c-763c-88jm osv.dev
• GitLab Advisory: better-auth CVE-2026-114607 advisories.gitlab.com
• Forkast: Better Auth OAuth state reuse via Magic Link forkast.news

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:44.