CVE-2026-110864

Deferred Deferred - Pending Action

Better Auth OAuth Proxy Authentication Bypass Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110864

EUVD

EUVD-2026-101747

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better-auth	1.5.0-beta.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Better Auth versions 1.5.0-beta.12 to 1.7.7 have an authentication bypass flaw in the OAuth Proxy plugin. Unauthenticated attackers can forge encrypted profiles to sign in as other users by exploiting shared global secrets and cookie-stored state. This allows account takeover via implicit linking when a victim's verified email is used in the forged profile.

Detection Guidance

This vulnerability involves an authentication bypass in Better Auth's OAuth Proxy plugin due to shared global secrets and cookie-stored state. Detection requires checking for unauthorized access attempts, unusual login patterns, or forged encrypted profiles. Review logs for multiple failed login attempts or unexpected session tokens. Inspect network traffic for suspicious OAuth callback requests. Ensure the plugin is updated to version 1.7.7 or later.

Impact Analysis

This vulnerability allows attackers to impersonate users without authentication, potentially accessing sensitive accounts or data. If you use Better Auth with the OAuth Proxy plugin in versions 1.5.0-beta.12 to 1.7.7, your accounts could be compromised, leading to unauthorized access to personal or organizational resources.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure or loss of control over user accounts.

Mitigation Strategies

Upgrade Better Auth to version 1.7.7 or later to address the authentication bypass in the OAuth Proxy plugin. Ensure the global secret is not shared and avoid using cookie-stored state for the proxy.

Hi! I’m here to help you understand CVE-2026-110864. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70