Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-110864 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	[email protected]

Affected Products

Product	Versions
Better Auth	>= 1.5.0-beta.12, < 1.7.7 (semver)
CPE cpe:2.3:a:better-auth:better_auth::::::node.js::* Remediation Upgrade: 1.7.7moderate effort Workaround:low effort Set a strong OAuth Proxy `secret` across all environments that participate in the proxy flow, ensuring it is different from each environment's global Better Auth secret. Workaround:low effort Set `account.storeStateStrategy: "database"`. This is the default when a database or secondary storage is configured. If Magic Link is also enabled, ensure that the two flows resolve to distinct stored identifiers; with built-in options, use Magic Link `storeToken: "hashed"` with global `verification.storeIdentifier` unset or "plain", or disable Magic Link or both built-in social and Generic OAuth sign-in. Workaround:low effort Remove the OAuth Proxy plugin if it is not needed. Workaround:low effort Set `account.accountLinking.disableImplicitLinking: true` to prevent account takeover. Note that this does not fix the underlying flaw, as the callback can still accept attacker-made data as a provider identity.

Product

Versions

Better Auth

>= 1.5.0-beta.12, < 1.7.7 (semver)

CPE

cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*

Remediation

Upgrade: 1.7.7moderate effort
Workaround:low effort
Set a strong OAuth Proxy `secret` across all environments that participate in the proxy flow, ensuring it is different from each environment's global Better Auth secret.
Workaround:low effort
Set `account.storeStateStrategy: "database"`. This is the default when a database or secondary storage is configured. If Magic Link is also enabled, ensure that the two flows resolve to distinct stored identifiers; with built-in options, use Magic Link `storeToken: "hashed"` with global `verification.storeIdentifier` unset or "plain", or disable Magic Link or both built-in social and Generic OAuth sign-in.
Workaround:low effort
Remove the OAuth Proxy plugin if it is not needed.
Workaround:low effort
Set `account.accountLinking.disableImplicitLinking: true` to prevent account takeover. Note that this does not fix the underlying flaw, as the callback can still accept attacker-made data as a provider identity.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 15, 2026	CVE Modified	CISA-ADP
Oct 14, 2026	New CVE Received	[email protected]