---
id: CVE-2026-114607
title: >-
  better-auth: OAuth state can be used as a Magic Link to sign in as another
  user
summary: >-
  Better Auth is an authentication and authorization library for TypeScript.
  From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with
  storeToken set to plain, or with storeToken set to hashed and the global
  verification.stor…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: better-auth
product: better-auth
affected:
  - 'better-auth >= 1.4.0-beta.18, < 1.7.7'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T16:47:27.480Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114607'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
    label: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
  - url: 'https://github.com/better-auth/better-auth/pull/11494'
    label: 'https://github.com/better-auth/better-auth/pull/11494'
  - url: >-
      https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a
    label: >-
      https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a
  - url: 'https://github.com/better-auth/better-auth/releases/tag/v1.7.7'
    label: 'https://github.com/better-auth/better-auth/releases/tag/v1.7.7'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.346Z'
---

## Overview

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.

## Affected

- `better-auth >= 1.4.0-beta.18, < 1.7.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.