CVE-2026-110862

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

CVSS 4.0

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-25)

CWE

CWE-287

Published

2026-10-14

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
• https://www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link

Check your stackJSON