Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

2. Oct 15, 2026 · NIST NVD

   Updated

   Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

Affected

• vendor better-auth better-authversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-110862

  Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit th

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-110862

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2026-110862

  Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit th

  nvd.nist.gov

References

• Reference · github.com
• Reference · vulncheck.com