CVE-2026-114607

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.4.0-beta.18 through 1.7.6

Description An issue exists where deployments using specific configurations can accept an OAuth sign-in state value as a Magic Link token. This occurs when Magic Link is enabled with storeToken set to plain (or storeToken and verification.storeIdentifier both set to hashed), a built-in social or Generic OAuth provider is active, and account.storeStateStrategy is set to database. This configuration allows Magic Link verification records and OAuth state to resolve to the same stored identifier. Consequently, an unauthenticated attacker can initiate an OAuth sign-in for a known email address and redeem the resulting state via Magic Link without accessing the mailbox or completing the provider callback, potentially gaining a session for an existing user or creating an account incorrectly marked as email verified.

Recommendations Update to version 1.7.7.