GHSA-w232-44q8-h37xPublished
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110864 · Microsoft / collected KEV context
cve-program · CVE-2026-110864
- https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
- https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy
euvd · EUVD-2026-101747
- https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
- https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy
nvd · CVE-2026-110864
- https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
- https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication-bypass-via-oauth-proxy
osv · GHSA-r4xp-prcw-77qf
- https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
- https://github.com/better-auth/better-auth/pull/11494
- https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.7.7
Related operational evidence
Explicit CVE identifiers- better-auth: OAuth Proxy lets an attacker sign in as another user · Newly collected advisory · 27 Oct 2026