CVE-2026-53516

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11

Description Better Auth contains a pre-account hijacking flaw where the OAuth callback auto-link gate in the handleOAuthUserInfo() function allows implicit account linking if the OAuth provider asserts email verified: true, without verifying if the local user row's emailVerified field is also true. An attacker can exploit this by pre-registering a victim's email address via the /sign-up/email endpoint. When the victim later attempts to sign in via OAuth, their identity is bound to the attacker's account, granting the attacker persistent access via password login. This issue also affects the one-tap sign-in plugin. Furthermore, setting emailAndPassword.requireEmailVerification: true does not mitigate this because the linking process automatically promotes the attacker's local account to a verified status.

Recommendations Upgrade to Better Auth version 1.6.11 or later. As a temporary workaround, set account.accountLinking.disableImplicitLinking to true to force linking through the authenticated /link-social endpoint. As a temporary workaround, set account.accountLinking.enabled to false to disable account linking entirely.