Critical severity9.1NVD Advisory· Published Oct 14, 2026

CVE-2026-110862

Description

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

Affected products

Better Auth/Better Authllm-fuzzy
Range: <1.7.7

Patches

Vulnerability mechanics

References

github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jmnvd
www.vulncheck.com/advisories/better-auth-1.4.0-beta.18-before-1.7.7-authentication-bypass-via-magic-linknvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000