High severity · published Oct 14, 2026
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
1.5.0-beta.12 before 1.7.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110864
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
www.vulncheck.com
https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins