Product
Better Auth is vulnerable to an authentication bypass where OAuth sign-in state can be used as a valid Magic Link token, allowing unauthenticated attackers to hijack user accounts or create unauthorized verified accounts.