Better Auth: Authentication bypass in OAuth Proxy plugin
Summary
The OAuth Proxy plugin of the Better Auth library in versions from 1.5.0-beta.12 before 1.7.7 trusts user profiles it can decrypt. An unauthenticated attacker can forge an encrypted profile with a victim's verified email address and sign in as that user via implicit account linking. The attack requires the OAuth Proxy plugin with a secret equal to the global Better Auth secret, and cookie-stored sign-in state.
Affected
- better-auth from 1.5.0-beta.12 before 1.7.7 with the OAuth Proxy plugin
- Only if the proxy secret is missing or equal to the global Better Auth secret, sign-in state is stored in a cookie, and implicit account linking is enabled (default)
Fixed in
- Fixed in better-auth 1.7.7; upgrade to the current 1.7.x patch release
- Keep other Better Auth packages on the same release version
- Upgrade all participating environments together; pre-upgrade state cookies are rejected
Workaround
- Set one strong OAuth Proxy secret across all participating environments that differs from the global Better Auth secret
- Set account.storeStateStrategy to "database" (note the possible Magic Link interaction described in the advisory)
- Remove the OAuth Proxy plugin if it is not needed
- Setting accountLinking.disableImplicitLinking to true limits takeover but does not fix the flaw
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- EPSS 0.00288; CISA SSVC: exploitation none, not automatable
Our recommendation
- Inventory all better-auth and @better-auth/* packages, including lockfiles and wrapper libraries
- Check whether the OAuth Proxy plugin is enabled and which secret it uses
- Upgrade to 1.7.7 or later, testing first, and upgrade all environments together
- Until then, apply one of the workarounds
- Also check whether Magic Link with social sign-in is used, as it is affected by a related advisory fixed in 1.7.7
- Monitor authentication logs for unexpected sign-ins to user accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r4xp-prcw-77qf github.com
- VulnCheck Advisory CVE-2026-110864 www.vulncheck.com
- Better Auth 1.7 Upgrade Guide better-auth.com
- VulDB CVE-2026-110864 vuldb.com
- Vulners VULNRICHMENT CVE-2026-110864 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:33.
Original description (NVD)
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.