Better Auth, a TypeScript authentication framework increasingly utilized in the Node.js and Next.js ecosystem, contains a critical vulnerability (GHSA-965c-763c-88jm) stemming from a failure in verification record isolation. The flaw allows an attacker to initiate an OAuth sign-in flow for a target email address, generate a state value, and then redeem that same value at the Magic Link endpoint to authenticate as the victim. Because the system stores OAuth state records and Magic Link tokens in the same verification store using identical, un-namespaced values, the Magic Link handler fails to distinguish between the two. This bypass requires no access to the victim’s mailbox and grants the attacker a full session with all associated permissions. The vulnerability is rated with a CVSS score of 9.1.
Recent security reporting has conflated this issue with other identifiers, leading to confusion in the developer community. Specifically, the identifier CVE-2026-110862, which has appeared in some dispatches, does not exist in the NVD, OSV, GitHub Advisory Database, or SentinelOne records. Furthermore, some sources have incorrectly attributed a CVSS score of 9.3 to this vulnerability, despite the official GitHub advisory maintaining a score of 9.1. Additionally, CVE-2026-67335, as documented by SentinelOne, refers to a separate, distinct vulnerability involving an OAuth state-parameter validation bypass in versions prior to 1.6.2. Distinguishing these events is necessary to ensure the correct remediation path is followed.
The underlying failure occurs when the federation layer implicitly trusts a security context without verifying that the context was generated for the specific operation being performed. Similar to issues observed in Keycloak (CVE-2026-15943) and BotSharp (CVE-2026-69570), the system assumes that the presence of a valid record in the verification store is sufficient proof of intent. It fails to account for the possibility that the record was created for a different, less-privileged, or entirely unrelated authentication flow. This architectural oversight allows the security context earned by a primary session to be inadvertently misapplied during cross-feature interactions.
The vulnerability was addressed in Better Auth version 1.7.7, released on September 30, 2026. The fix introduces strict namespace separation by applying magic-link: and auth-state: prefixes to all verification records. Additionally, the update implements separate encryption keys for each OAuth purpose, ensuring that a token generated for one flow cannot be cryptographically validated for another. This remediation does not require database schema changes or user account migrations. However, administrators should note that this update requires a coordinated cutover for servers sharing verification storage, as magic links issued prior to the upgrade will be invalidated, and pending OAuth or SAML sign-ins will need to be restarted.
The absence of confirmed exploitation in the wild or a public proof-of-concept does not diminish the risk for applications relying on Better Auth. If Magic Link sign-up is enabled, an attacker could create a falsely-verified account for an email address that does not yet exist in the system. This false verification flag can bypass default unproven-account protections when the legitimate mailbox owner eventually attempts to sign in. Simply setting disableSignUp: true is insufficient, as this only prevents the creation of new verified accounts and does not mitigate the risk of taking over existing ones. For those unable to upgrade immediately, recommended workarounds include setting the account.storeStateStrategy to cookie, or configuring the Magic Link storeToken to use a hashed value while ensuring the global verification.storeIdentifier remains unset or plain.