Better Auth: OAuth state accepted as Magic Link token enables account takeover

Summary

Better Auth, an authentication library for TypeScript, can accept an OAuth sign-in state value as a Magic Link token under a specific combination of settings. An unauthenticated attacker who knows a user's email address can start an OAuth sign-in and redeem the returned state through Magic Link without access to the mailbox. This can yield a session for an existing user or an account marked as email-verified when sign-up is enabled.

Affected

• better-auth from 1.4.0-beta.18 up to, but not including, 1.7.7
• Only deployments with the Magic Link plugin, storeToken set to plain (or hashed with verification.storeIdentifier also hashed), a built-in social or Generic OAuth provider, and account.storeStateStrategy set to database

Fixed in

• Fixed in better-auth 1.7.7 (released Sep 30, 2026)
• Upgrade all @better-auth/* packages together with better-auth

Workaround

• Turn off Magic Link sign-in, or turn off social and Generic OAuth sign-in, as stated by the vendor
• Disabling sign-up on the Magic Link plugin is not sufficient
• Unverified: set account.storeStateStrategy to cookie

Exploitation

• No public proof-of-concept or reports of exploitation in the wild were found in the research.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• The CISA KEV catalogue was not checked directly.

Our recommendation

• Check lockfiles for better-auth versions below 1.7.7 and upgrade to the latest 1.7.x release.
• Review the auth configuration for Magic Link, social or Generic OAuth providers, storeToken, storeIdentifier and storeStateStrategy.
• After upgrading, expire pending Magic Links and OAuth sign-ins, as they do not complete after the change.
• Review accounts created or signed in via Magic Link during the exposure window.
• Apply the workaround if patching is not possible immediately.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-965c-763c-88jm github.com
• Better Auth release v1.7.7 github.com
• Fix pull request #11494 github.com
• Fix commit ac54bfd github.com
• OSV GHSA-965c-763c-88jm osv.dev
• GitLab advisory CVE-2026-114607 advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:31.