Better Auth flaw allows unauthenticated login via OAuth state reuse

The National Vulnerability Database has published details for CVE-2026-110862, a critical authentication bypass flaw in the open-source library Better Auth. The vulnerability allows unauthenticated attackers to impersonate legitimate users by abusing the way the library handles OAuth state values and magic link verification processes.

According to the NVD record, the issue is associated with CWE-287. Attackers can initiate an OAuth sign-in flow using a victim's email address, capture the resulting state parameter, and submit that value to the magic link verification endpoint. This action grants the attacker a valid session or allows them to generate accounts that appear to be email-verified without actually owning the address.

Technical Scope and Severity

The vulnerability is rated at 9.3 on the Common Vulnerability Scoring System, placing it in the highest severity tier. This score reflects the ease with which an attacker can exploit the flaw without any prior authentication or credentials. The affected software components span from version 1.4.0-beta.18 up to, but not including, version 1.7.7. Any deployment using these earlier releases is exposed to this specific attack vector.

The mechanics of the exploit rely on the library treating OAuth state tokens as valid magic link tokens. This confusion of distinct security tokens allows an attacker to bridge the gap between initiating a login flow and completing verification. The result is full account takeover or the creation of spoofed identities that bypass standard email confirmation checks.

Impact on Developers and Users

Developers integrating Better Auth into their applications for user authentication are directly impacted by this finding. The library is often used to manage sign-in flows, meaning that any application relying on its default OAuth or magic link configurations is vulnerable. Users of applications built with these affected versions face the risk of account compromise, where an attacker gains access without knowing the user's password.

This incident highlights the risks of complex authentication chains where multiple token types interact. While similar flaws in other infrastructure components, such as the AhsayCBS hotfixes released in October 2026, address remote code execution, this issue is specific to identity verification. Unlike the Juniper Junos OS J-Web flaw reported earlier in 2026, which allowed code execution via crafted HTTP requests, this vulnerability is strictly an authentication bypass.

What should you do?

Organizations using Better Auth should immediately audit their deployment versions to determine if they fall within the vulnerable range. If the software is running a version prior to 1.7.7, teams should prepare to upgrade as soon as a secure update is available. Monitoring authentication logs for unusual patterns, such as repeated magic link verifications following OAuth initiations, can help detect active exploitation.