{"id":"EUVD-2026-108256","enisaUuid":"4145683b-16b5-3d23-9979-677f735c13e1","description":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","datePublished":"Oct 27, 2026, 3:32:05 PM","dateUpdated":"Oct 27, 2026, 3:32:05 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm\nhttps://github.com/better-auth/better-auth/pull/11494\nhttps://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a\nhttps://github.com/better-auth/better-auth/releases/tag/v1.7.7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114607\n","aliases":"CVE-2026-114607\nGHSA-965c-763c-88jm\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"c55bd0a6-c4b5-396f-88db-61557d0469dd","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.4.0-beta.18, \u003c 1.7.7"}],"enisaIdVendor":[{"id":"414fffe6-f3f5-3f49-b8d3-1bb9dbb30b36","vendor":{"name":"better-auth"}}],"enisaIdVulnerability":[{"id":"28c823cd-bdfd-362f-b0ee-acf83cd8eb2f","vulnerability":{"id":"CVE-2026-114607","description":"Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.","datePublished":"Oct 22, 2026, 4:47:27 PM","dateUpdated":"Oct 23, 2026, 3:02:40 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm\nhttps://github.com/better-auth/better-auth/pull/11494\nhttps://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a\nhttps://github.com/better-auth/better-auth/releases/tag/v1.7.7\n","enisa_id":"EUVD-2026-108256\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"e309e1ff-3fe0-305f-88bb-f828e59d3b2d","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.4.0-beta.18, \u003c 1.7.7"}],"vulnerabilityVendor":[{"id":"6f9ce4a7-d03d-33c1-bf4d-d97dd05c4bef","vendor":{"name":"better-auth"}}]}},{"id":"afd6c86d-5a46-3f65-8cc7-964e877f1aee","vulnerability":{"id":"GHSA-965c-763c-88jm","description":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","datePublished":"Oct 27, 2026, 3:32:05 PM","dateUpdated":"Oct 27, 2026, 3:32:05 PM","baseScore":0.0,"references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114607\nhttps://github.com/better-auth/better-auth/pull/11494\nhttps://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a\nhttps://github.com/better-auth/better-auth\nhttps://github.com/better-auth/better-auth/releases/tag/v1.7.7\n","enisa_id":"EUVD-2026-108256\n","aliases":"CVE-2026-114607\nGHSA-965c-763c-88jm\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}