CVE-2026-110862

Deferred Deferred - Pending Action

Authentication Bypass in Better Auth via OAuth State Reuse

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110862

EUVD

EUVD-2026-101745

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better-auth	1.4.0-beta.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Better Auth versions 1.4.0-beta.18 to 1.7.6 have an authentication bypass flaw. Unauthenticated attackers can sign in as other users by reusing OAuth state values as Magic Link tokens. This happens when an attacker initiates OAuth login with a victim's email and submits the returned state to Magic Link verification, allowing session hijacking or creating falsely email-verified accounts.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual authentication patterns, particularly OAuth state reuse or Magic Link token validation bypasses. Check logs for multiple successful authentications with the same OAuth state value or Magic Link tokens submitted without proper OAuth flow initiation. Inspect network traffic for repeated state parameters in OAuth callbacks or Magic Link verification endpoints.

Impact Analysis

Attackers could gain unauthorized access to user accounts, steal sensitive data, or perform actions on behalf of victims. Systems relying on Better Auth for authentication may experience account takeovers, data breaches, or fraudulent activities without proper user credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance failures, legal penalties, and reputational damage due to potential data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Better Auth to version 1.7.7 or later to address the authentication bypass vulnerability. Review OAuth and Magic Link token handling to ensure state values are not reused or exposed. Monitor for unauthorized sessions or falsely email-verified accounts.

Hi! I’m here to help you understand CVE-2026-110862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70