Critical severity · published Oct 14, 2026
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
1.4.0-beta.18 before 1.7.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110862
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
www.vulncheck.com
https://www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-link
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
8.7
CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider