Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| better-auth | better-auth | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts. | |
| Title | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link | |
| First Time appeared |
Better-auth
Better-auth better Auth |
|
| Weaknesses | CWE-287 | |
| CPEs | cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Better-auth
Better-auth better Auth |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T22:52:46.811Z
Reserved: 2026-10-14T22:18:33.239Z
Link: CVE-2026-110862
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T23:17:27.673
Modified: 2026-10-14T23:17:27.673
Link: CVE-2026-110862
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-287
Improper Authentication