CVE-2026-110862
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that…
- Risk score
- 64/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verifica…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.7.7 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
Last activity 14 Oct 2026. Patch Forecast updates every hour.