better-auth OAuth State Bypass Auth Vulnerability (GHSA-4m6w-7q5j-2g7j)

better-auth Vulnerability Summary Vulnerability Overview The OAuth state value in better-auth can be exploited as a "magic link" for user authentication. Attackers can use the OAuth plugin to send emails containing state values to arbitrary email addresses and forge login requests for those addresses, thereby bypassing authentication mechanisms. Affected Scope Affected Versions: better-auth from v3.1.8 to v3.18 (inclusive) when installed via the package. Affected Features: - Login using OAuth plugins (e.g., Google, GitHub, etc.). - State values not properly bound to user sessions or email addresses. Risk Level: High (CVSS 8.1 / 9.0) Affected Users: All users employing affected versions with OAuth login enabled. Remediation Fixed Version: This vulnerability is fixed in v3.19 and later. Temporary Mitigations: - Set in the configuration. - Disable OAuth login functionality (e.g., temporarily disable the plugin). - Enforce email verification for users upon their first login. Official Patch: - Upgrade to the latest stable version (v3.19+). - Apply the official patch released by the maintainers (see the section in the GitHub repository). POC Code / Exploitation Code No complete POC or exploitation code is provided on the page; only the vulnerability principle and attack flow are described. Below are the key steps (not complete code): > Note: Actual exploitation requires specific OAuth providers and better-auth configurations. It is recommended to refer to official documentation or security advisories for detailed POCs. Additional Information Vulnerability ID: GHSA-4m6w-7q5j-2g7j Disclosure Date: October 28, 2024 Fix Date: November 1, 2024 Affected Component: better-auth package (npm) Related Resources: - GitHub Repository - Official Documentation - Security Advisory

Goal Reached Thanks to every supporter — we hit 100%!

better-auth OAuth State Bypass Auth Vulnerability (GHSA-4m6w-7q5j-2g7j)

More from this source