CVE-2026-110864— Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Quick assessment
Affected
better-auth better-auth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Better Auth 版本从 1.5.0-beta.12 到 1.7.7（不含 1.7.7）存在一个身份验证绕过漏洞，位于 OAuth Proxy 插件中。该漏洞允许未认证的攻击者通过伪造加密配置文件，以其他用户的身份登录。当代理共享全局密钥并使用 cookie 存储状态时，攻击者可以获取包含受害者已验证电子邮件的伪造配置文件的加密状态，从而通过隐式链接接管该用户账户。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | better-auth | 1.5.0-beta.12< 1.7.7 |
affected |
1.7.7 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110864
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Source: CVE Program / CVE List V5
Vulnerability Description
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | better-auth | 1.5.0-beta.12 ~ 1.7.7 | - |
|
II. Public POCs for CVE-2026-110864
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110864
请登录查看更多情报信息。
Other References for CVE-2026-110864 (2)
Same Patch Batch · better-auth · 2026-10-14 · 4 CVEs total
| CVE-2026-110862 | 9.1 CRITICAL | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link |
| CVE-2026-110863 | 8.1 HIGH | Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers |
| CVE-2026-110861 | 3.7 LOW | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition |
IV. Related Vulnerabilities
Same product: better-auth
-
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass -
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorizat -
CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS -
CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3 -
CVE-2026-67337
better-auth before 1.4.9 Two-Factor Authentication Bypass vi
Same vendor: better-auth
-
CVE-2026-110863
Better Auth @better-auth/sso before 1.7.3 Authentication Byp -
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass -
CVE-2026-110861
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit B -
CVE-2026-109346
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorizat -
CVE-2026-80192
better-auth SSO before 1.6.27 Domain Ownership Authenticatio
Same weakness: CWE-287
-
CVE-2026-68573
Apache Kylin: Unauthenticated Metastore Cleanup -
CVE-2026-17488
IBM i is Affected By An Improper Authentication Vulnerabilit -
CVE-2026-111639
bbs-go through 4.4.6 Account Takeover via Google One Tap Log -
CVE-2026-75903
Vulnity Security <= 1.4.3 - Unauthenticated Authentication B -
CVE-2026-103895
miniOrange OTP Login, Verification and SMS Notifications <=
V. Comments for CVE-2026-110864
No comments yet