CVE-2026-53516 Details
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.
A vulnerability in Better Auth's OAuth callback handling prior to version 1.6.11 allows for implicit account linking based on the OAuth provider's email verification status. This issue arises because the library accepts the provider's assertion of a verified email without requiring confirmation from its own user database. As a result, an attacker can pre-register an email address through the application's sign-up process, wait for the victim to log in via an OAuth provider, and then link the victim's account to the attacker's profile. This vulnerability affects users who sign up through OAuth without verifying their email locally, and it is present in versions of Better Auth prior to 1.6.11.
Users can upgrade to Better Auth version 1.6.11 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, the option to disable implicit linking or account linking entirely is available, though this may disrupt the user experience.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth better auth | < 1.6.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | New CVE Received | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |