{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/better-auth--1.3.8-beta.3--1.7.0-rc.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-114607"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["better-auth (\u003c 1.7.7)","better-auth (\u003e= 1.3.8-beta.3, \u003c 1.7.0-rc.3)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-vulnerability","cloud","account-takeover","authentication","oauth","phishing","session-hijacking"],"_cs_type":"advisory","_cs_vendors":["better-auth"],"content_html":"\u003cp\u003eBetter Auth versions 1.4.0-beta.18 through 1.7.6 are vulnerable to an authentication bypass (CVE-2026-114607). The library incorrectly allows an OAuth sign-in state value to be accepted as a valid Magic Link token. An attacker can initiate an OAuth flow for a specific target email address, obtain the resulting state identifier, and submit it to the Magic Link endpoint to complete authentication as that user. This vulnerability persists if specific configurations regarding \u003ccode\u003estoreToken\u003c/code\u003e and \u003ccode\u003estoreIdentifier\u003c/code\u003e strategies are in use.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initiates an OAuth sign-in flow through Better Auth for a target email address.\u003c/li\u003e\n\u003cli\u003eThe application generates an OAuth state value to track this session.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts or extracts the OAuth state value associated with the target email address.\u003c/li\u003e\n\u003cli\u003eThe attacker submits the stolen OAuth state value to the Magic Link authentication endpoint.\u003c/li\u003e\n\u003cli\u003eBetter Auth erroneously treats the OAuth state value as a valid Magic Link token.\u003c/li\u003e\n\u003cli\u003eThe system grants the attacker a session associated with the target email address.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to gain full access to any existing user account if the email address is known, bypassing the need for mailbox access. If Magic Link sign-up is enabled for a non-existent email address, the attacker can create an account that the system incorrectly marks as email-verified, which can be leveraged to bypass secondary security controls or access gated application features.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ebetter-auth\u003c/code\u003e to version 1.7.7 or later as soon as it is released.\u003c/li\u003e\n\u003cli\u003eUntil the update is applied, prioritize switching \u003ccode\u003eaccount.storeStateStrategy\u003c/code\u003e to \u003ccode\u003e\u0026quot;cookie\u0026quot;\u003c/code\u003e if feasible, or disable the vulnerable combinations of Magic Link and social/Generic OAuth providers.\u003c/li\u003e\n\u003cli\u003eEnsure all internal Better Auth plugins, adapters, and integrations are updated in synchronization with the core library to ensure consistent verification logic.\u003c/li\u003e\n\u003cli\u003eReview and update custom \u003ccode\u003everification.storeIdentifier.overrides\u003c/code\u003e to include the \u003ccode\u003emagic-link:\u003c/code\u003e and \u003ccode\u003eauth-state:\u003c/code\u003e prefixes as required by the upcoming security patch.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T17:58:10Z","date_published":"2026-10-27T17:53:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-oauth-magic-link-bypass/","summary":"Better Auth is vulnerable to an authentication bypass where OAuth sign-in state can be used as a valid Magic Link token, allowing unauthenticated attackers to hijack user accounts or create unauthorized verified accounts.","title":"Better Auth: OAuth state-to-Magic Link authentication bypass (CVE-2026-114607)","url":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-oauth-magic-link-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Better-Auth (\u003e= 1.3.8-Beta.3, \u003c 1.7.0-Rc.3)","version":"https://jsonfeed.org/version/1.1"}