Attackers Bypass Better Auth Login by Swapping OAuth Tokens for Magic Links

Attackers can sign in as other users in vulnerable versions of Better Auth without authentication. By exploiting a flaw in how the library handles tokens, malicious actors can bypass security checks. This capability allows them to gain sessions or create falsely email-verified accounts. The issue stems from a confusion between two different login methods, creating a path for unauthorized access that requires no initial credentials.

In plain English

The vulnerability exists because the software treats two different types of security tokens as if they were the same. When a user starts logging in through an external provider, the system generates a temporary code called a state value. Normally, this code is only used to complete that specific external login. However, attackers can take this code and submit it as if it were a verification link for a password-less "Magic Link" login. The system accepts it, allowing the attacker to gain sessions or create falsely email-verified accounts.

The background

The flaw is tracked as CVE-2026-110862 and has a CVSS score of 9.3, which is rated as critical. It impacts Better Auth versions starting from 1.4.0-beta.18 and continuing through all releases before 1.7.7. The weakness is classified under CWE-287, which refers to improper authentication mechanisms. This incident follows a trend of complex authentication libraries introducing subtle logic errors that attackers can exploit to bypass standard security controls.

What changes now

Security teams must immediately audit their deployments of Better Auth to determine if they are running vulnerable versions. Any instance using a version lower than 1.7.7 is exposed to this specific authentication bypass technique. Organizations should prioritize upgrading to version 1.7.7 or later to patch the flaw. Until updates are applied, monitoring for unusual login patterns, especially those involving OAuth providers and Magic Link verifications, can help detect potential exploitation attempts.

What made it possible

This incident highlights the risks of conflating distinct authentication flows within a single library. Teams usually encounter this class of vulnerability when different login methods, such as social logins and email verification, share internal state management without strict isolation. The weakness serves the initial access stage of an intrusion, allowing attackers to bypass identity verification entirely.

Security professionals should check whether their authentication logic enforces strict boundaries between token types. Misusing state values across different verification endpoints is a common architectural flaw that enables account takeover without requiring prior credentials or complex exploits.

What to do and how to stay safe: Better Auth

• Review your current Better Auth version and upgrade to 1.7.7 or later to close the authentication bypass gap.
• Monitor authentication logs for sequences where an OAuth initiation is immediately followed by a Magic Link verification success.
• Implement additional verification steps for high-privilege accounts to mitigate the impact of potential session hijacking.
• Ensure that OAuth state tokens are strictly validated against the originating provider and not accepted by other login endpoints.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Better Auth are affected by this vulnerability?

The flaw affects versions from 1.4.0-beta.18 up to, but not including, version 1.7.7.

What is the CVSS score for CVE-2026-110862?

The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.3.

How do attackers exploit this flaw to gain access?

Attackers start an OAuth sign-in with a victim's email and submit the returned state value to the Magic Link verification endpoint.