Better Auth OAuth flaw lets attackers bypass login as any user

A critical authentication bypass in Better Auth allows unauthenticated attackers to assume the identity of other users. The flaw enables adversaries to reuse OAuth state values as magic link tokens, effectively bypassing standard login procedures.

What happened

The National Vulnerability Database records CVE-2026-110862 as affecting Better Auth versions starting from 1.4.0-beta.18 through any release prior to 1.7.7. According to the advisory, the vulnerability allows unauthenticated attackers to sign in as other users.

An attacker can initiate an OAuth sign-in process using a victim's email address. The system returns a state value during this flow. The attacker then submits this returned state to the magic link verification endpoint. This action allows the attacker to gain sessions or create falsely email-verified accounts.

Consequently, the attacker gains an active session for the target user. Alternatively, the adversary can create new accounts that appear to have verified email addresses. The National Vulnerability Database classifies this as a critical severity issue with a CVSS score of 9.3.

Why it matters

Security operations teams must recognize that this flaw allows unauthenticated access to user accounts. The reuse of state values means that an attacker does not need to intercept tokens in transit.

Instead, the attacker simply needs to trigger the OAuth flow and capture the resulting state. This makes the attack surface wider than typical credential theft scenarios. Any environment using affected versions of Better Auth is exposed to full account takeover.

The ability to create falsely verified accounts allows attackers to establish new identities within the system. This expands the scope of the compromise beyond existing user accounts.

Our take on the response

• Identify all instances of Better Auth in production and staging environments.
• Verify the current version against the affected range of 1.4.0-beta.18 to 1.7.6.
• Plan an immediate upgrade path to version 1.7.7 or later.
• Review recent login logs for anomalies in authentication method switching.

What defenders should look for

Teams usually detect this activity by monitoring for unusual authentication patterns. Look for OAuth initiation events followed immediately by magic link verification attempts from the same source. Check for sessions that start with OAuth parameters but complete via magic link endpoints.

Review account creation logs for new users with instant email verification status. Investigate any spikes in failed magic link attempts that coincide with OAuth requests. Contain potential compromises by forcing password resets for affected accounts.

What to do and how to stay safe: Better Auth

• Audit your dependency tree to confirm if Better Auth is present in your stack.
• Check your application logs for sequences where OAuth states are used in magic link endpoints.
• Monitor for new accounts that were created and verified within seconds of each other.
• Prepare to update to the patched version once the vendor provides an update.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Better Auth are affected by this vulnerability?

Versions from 1.4.0-beta.18 up to, but not including, 1.7.7 are affected.

How do attackers exploit this flaw?

Attackers reuse OAuth state values as magic link tokens to bypass authentication.

What is the severity rating for CVE-2026-110862?

The National Vulnerability Database rates it as critical with a CVSS score of 9.3.