CVE-2026-114607 Details

A vulnerability in Better Auth, an authentication library for TypeScript, allows an unauthenticated attacker to use an OAuth sign-in state value as a Magic Link token, potentially taking over a user's account. This issue affects Better Auth versions 1.4.0-beta.18 prior to 1.7.7, specifically in deployments that enable Magic Link with certain token storage settings, activate a social or Generic OAuth provider, and use database-backed OAuth state. The vulnerability arises because Magic Link verification records and OAuth state can resolve to the same identifier, enabling attackers to initiate an OAuth sign-in for a known email address and complete the process using Magic Link, without accessing the email or finishing the OAuth callback. As a result, attackers can gain a session for an existing user or create a new account falsely marked as email verified.

Upgrade Better Auth to version 1.7.7, which isolates verification records and encryption purposes, addressing the vulnerability. After upgrading, request new Magic Links and restart any pending OAuth or SAML sign-ins that used Better Auth-generated state, as older links and states cannot be completed. If using OAuth Proxy, ensure all participating environments are upgraded together.