Better Auth: OAuth state-to-Magic Link authentication bypass (CVE-2026-114607)

Better Auth versions 1.4.0-beta.18 through 1.7.6 are vulnerable to an authentication bypass (CVE-2026-114607). The library incorrectly allows an OAuth sign-in state value to be accepted as a valid Magic Link token. An attacker can initiate an OAuth flow for a specific target email address, obtain the resulting state identifier, and submit it to the Magic Link endpoint to complete authentication as that user. This vulnerability persists if specific configurations regarding storeToken and storeIdentifier strategies are in use.

Attack Chain

1. Attacker initiates an OAuth sign-in flow through Better Auth for a target email address.
2. The application generates an OAuth state value to track this session.
3. The attacker intercepts or extracts the OAuth state value associated with the target email address.
4. The attacker submits the stolen OAuth state value to the Magic Link authentication endpoint.
5. Better Auth erroneously treats the OAuth state value as a valid Magic Link token.
6. The system grants the attacker a session associated with the target email address.

Impact

Successful exploitation allows an unauthenticated attacker to gain full access to any existing user account if the email address is known, bypassing the need for mailbox access. If Magic Link sign-up is enabled for a non-existent email address, the attacker can create an account that the system incorrectly marks as email-verified, which can be leveraged to bypass secondary security controls or access gated application features.

Recommendation

• Upgrade better-auth to version 1.7.7 or later as soon as it is released.
• Until the update is applied, prioritize switching account.storeStateStrategy to "cookie" if feasible, or disable the vulnerable combinations of Magic Link and social/Generic OAuth providers.
• Ensure all internal Better Auth plugins, adapters, and integrations are updated in synchronization with the core library to ensure consistent verification logic.
• Review and update custom verification.storeIdentifier.overrides to include the magic-link: and auth-state: prefixes as required by the upcoming security patch.