What’s Vulnerable › Vulnerabilities

CVE-2026-110862: Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-287

Description

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

Affected products

• better-auth: from 1.4.0-beta.18 before 1.7.7 — fixed in 1.7.7

How to fix

Upgrade to a fixed version: better-auth 1.7.7. Check the vendor advisory for mitigations.

References

• https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
• https://www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link

Get alerted when CVE-2026-110862 or the next vulnerability affects your stack