{"id":"CVE-2026-114607","state":"PUBLISHED","title":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","description":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.","publishedAt":"2026-10-22T16:47:27.480Z","updatedAt":"2026-10-23T15:02:40.820Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["better-auth better-auth"],"affected":[{"vendor":"better-auth","product":"better-auth","versions":[{"version":">= 1.4.0-beta.18, < 1.7.7","status":"affected"}]}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","https://github.com/better-auth/better-auth/pull/11494","https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a","https://github.com/better-auth/better-auth/releases/tag/v1.7.7"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/114xxx/CVE-2026-114607.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-114607","state":"PUBLISHED","datePublished":"2026-10-22T16:47:27.480Z","dateUpdated":"2026-10-23T15:02:40.820Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-10-21T20:34:25.599Z"},"containers":{"cna":{"title":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","descriptions":[{"lang":"en","value":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7."}],"affected":[{"vendor":"better-auth","product":"better-auth","versions":[{"version":">= 1.4.0-beta.18, < 1.7.7","status":"affected"}]}],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","name":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/better-auth/better-auth/pull/11494","name":"https://github.com/better-auth/better-auth/pull/11494","tags":["x_refsource_MISC"]},{"url":"https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a","name":"https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a","tags":["x_refsource_MISC"]},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","name":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","lang":"en","description":"CWE-287: Improper Authentication","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-22T16:47:27.480Z"},"source":{"advisory":"GHSA-965c-763c-88jm","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-23T14:55:53.151034Z","id":"CVE-2026-114607","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-23T15:02:40.820Z"}}]}}}