Description

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-10-14T23:17:27.673Z",
  "pubdate": "2026-10-14T23:17:27.673Z",
  "executiveSummary": "Better Auth versions 1.4.0-beta.18 through 1.7.6 are vulnerable to an authentication bypass flaw arising from improper validation logic within the authentication flow.\nThe vulnerability allows unauthenticated attackers to impersonate arbitrary users or create falsely verified accounts by misusing OAuth state values.\nBy manipulating the OAuth protocol handshake, an attacker can leverage the returned state value as a functional Magic Link token.\nThis flaw effectively bypasses standard authentication requirements, granting unauthorized actors session access or the ability to compromise existing user accounts.\nThe risk implication is critical, as it compromises the integrity of the authentication service, allowing for unauthorized account takeovers without requiring credentials or legitimate access to a user's inbox.\nExploitation requires only knowledge of the target's email address and the ability to interact with the authentication endpoint, making this a low-complexity attack vector with significant impact.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic flaw within the Better Auth authentication service where the state parameter, intended for Cross-Site Request Forgery (CSRF) protection during OAuth flows, is treated interchangeably with Magic Link authentication tokens.\nIn a standard implementation, an OAuth state value should be a cryptographically secure, opaque string uniquely bound to the specific authorization session. However, in the affected versions, the backend fails to differentiate between the purpose of the OAuth state and the tokens utilized for Magic Link verification.\nThe attack flow begins when an attacker initiates an OAuth sign-in request targeting a victim's email address. Upon reaching the authorization server, the service generates an OAuth state value and returns it to the client. Instead of discarding this value after the OAuth handshake, the attacker intercepts or observes this state value and submits it to the application's Magic Link verification endpoint.\nBecause the system incorrectly validates the state as a legitimate Magic Link token, the application processes the request as a successful authentication event. This grants the attacker a valid session for the victim's account, or, if the victim does not have an account, the process may trigger the creation of a falsely verified account associated with the victim's email address.\nThe vulnerable component is the internal authentication handler responsible for mapping disparate authentication methods to a common session validation function. The logic fails to enforce strict type checking or scoping on the token verification input, leading to a breakdown in protocol isolation. This issue affects versions 1.4.0-beta.18 up to, but not including, 1.7.7.\nThis vulnerability is reachable over the network and requires no special privileges or prior authentication. It constitutes a direct bypass of the authentication mechanism, allowing for unauthorized account access and identity theft. The post-exploitation impact includes full session hijacking of the target user's account and the ability to perform any actions available to the compromised user, effectively nullifying the security guarantees provided by the Better Auth framework."
}