better-auth: OAuth state accepted as a Magic Link token enables account takeover by email (CVE-2026-114607)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-114607
In better-auth from 1.4.0-beta.18 up to 1.7.7, the value that an OAuth sign-in creates as its state can be used as a Magic Link token. An unauthenticated attacker who knows a victim's email address can start an OAuth sign-in for that address, reuse the state value to complete a Magic Link sign-in, and receive a full session for the account without ever reading that mailbox. The attacker can also create an account that is wrongly marked as email verified when the address is not yet registered and Magic Link sign-up is enabled. The bug needs three conditions: Magic Link enabled with the default plain token storage (or hashed tokens with hashed identifiers), at least one social or Generic OAuth provider, and database-backed OAuth state, which is the default. Fixed in 1.7.7. Upgrade every Better Auth adapter and plugin together, and move shared verification storage in the same cutover. Until then, the advisory's workarounds are cookie-backed OAuth state, hashed Magic Link tokens with plain identifiers, or turning off Magic Link or OAuth sign-in. No known in-the-wild exploitation.
What to do
- Upgrade better-auth and all Better Auth adapters, plugins, and integrations to 1.7.7 together; upgrade servers sharing verification storage in the same cutover
- Until upgraded, set account.storeStateStrategy to "cookie" (with a dedicated OAuth Proxy secret if using OAuth Proxy), or set Magic Link storeToken to "hashed" with verification.storeIdentifier unset/plain, or disable Magic Link or OAuth sign-in
- Request new Magic Links and restart pending OAuth/SAML sign-ins after upgrading; pre-upgrade links and state cannot complete
- Update custom verification.storeIdentifier.overrides rules to match the magic-link: and auth-state: prefixes
- Audit accounts for falsely verified emails and review permissions granted based on verified email addresses or domains
Fixed versions
- better-auth 1.7.7 (npm publish 2026-09-30)
Sources
All live incidents on Threat Watch
