CVE-2026-110862

Summary

The vulnerability allows attackers to bypass authentication by reusing OAuth state values as Magic Link tokens, enabling them to sign in as any user without proper credentials. This creates a critical risk of unauthorized access and account takeover.

Exploitability

Exploitation is relatively straightforward requiring only the ability to initiate OAuth sign-in with a victim's email address and then reuse the returned state parameter, with no prerequisites for authentication or privileged access.

Blast radius

The impact could be extensive as attackers can gain full session access or create falsely email-verified accounts for any user in the system, potentially leading to widespread unauthorized access and data compromise.

Detection

Monitor for unusual OAuth state parameter usage patterns in authentication logs, particularly when state parameters are reused across different user sessions or when Magic Link verification requests contain unexpected state values from previous OAuth flows.

Prioritized remediation

Upgrade to Better Auth version 1.7.7 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.