CVE-2026-110862— Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Quick assessment
Affected
better-auth better-auth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Better Auth 在 1.4.0-beta.18 至 1.7.7 版本之间存在一个身份验证绕过漏洞，攻击者可利用该漏洞通过复用 OAuth 状态值作为 Magic Link 令牌，以其他用户的身份进行登录。攻击者可以先使用受害者的邮箱发起 OAuth 登录流程，然后将返回的状态值提交至 Magic Link 验证环节，从而获取合法会话或创建邮箱被错误标记为已验证的虚假账户。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110862
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
Source: CVE Program / CVE List V5
Vulnerability Description
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | better-auth | 1.4.0-beta.18 ~ 1.7.7 | - |
|
II. Public POCs for CVE-2026-110862
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110862
请登录查看更多情报信息。
Other References for CVE-2026-110862 (2)
Same Patch Batch · better-auth · 2026-10-14 · 4 CVEs total
| CVE-2026-110863 | 8.1 HIGH | Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers |
| CVE-2026-110864 | 7.4 HIGH | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy |
| CVE-2026-110861 | 3.7 LOW | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition |
IV. Related Vulnerabilities
Same product: better-auth
-
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorizat -
CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS -
CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3 -
CVE-2026-67337
better-auth before 1.4.9 Two-Factor Authentication Bypass vi
Same vendor: better-auth
-
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-110863
Better Auth @better-auth/sso before 1.7.3 Authentication Byp -
CVE-2026-110861
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit B -
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorizat -
CVE-2026-80192
better-auth SSO before 1.6.27 Domain Ownership Authenticatio
Same weakness: CWE-287
-
CVE-2026-45451
Unitronics - CWE-287: Improper Authentication -
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-110863
Better Auth @better-auth/sso before 1.7.3 Authentication Byp -
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an exis -
CVE-2026-104105
FileRise: TOTP codes are not single-use — valid 6-digit code
V. Comments for CVE-2026-110862
No comments yet