CVE-2026-114607

Summary

Better Auth versions before 1.7.7 allow an authentication bypass when Magic Link tokens and OAuth state values collide under specific misconfigured settings, letting an attacker impersonate a known user or create a pre-verified account without email control.

Exploitability

Exploitation requires the target to have enabled Magic Link with storeToken=plain (or storeToken=hashed + global storeIdentifier=hashed), a Generic OAuth provider configured, and account.storeStateStrategy set to database; under these conditions, an unauthenticated attacker can exploit it by initiating an OAuth flow and reusing the state as a Magic Link token.

Blast radius

Successful exploitation grants full authenticated session access for any existing user or allows creation of an email-verified account, enabling account takeover or unauthorized sign-up with elevated trust.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Better Auth version 1.7.7 or later, which fixes the token/state collision vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.