better-auth: OAuth state can be used as a Magic Link to sign in as another user

{
  "id": "56b37748459395acc7712e33adbc4447465c343a44218633b273bcac1b72536c",
  "url": "https://osv.dev/vulnerability/GHSA-965c-763c-88jm",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "better-auth: OAuth state can be used as a Magic Link to sign in as another user",
    "summary": "## Am I affected? You may be affected if you use `better-auth` from `1.4.0-beta.18` through versions before `1.7.7` with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if **all** of these are true: - Magic Link is enabled with default `storeToken: \"plain\"`, or with `storeToken: \"hashed\"` and global `verification.storeIdentifier: \"hashed\"` (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses `account.storeStateStrategy: \"database\"`, the default when a database or secondary storage is configured. Cookie-backed state blocks this path, subject to the OAuth Proxy condition below. With custom hashers, confirm the flows cannot resolve to the same stored identifier. ## Summary Better Auth accepts an OAuth sign-in state value as a Magic Link token. An attacker can start an OAuth sign-in with any email address and use the returned state value to finish a Magic Link sign-in for that address. They never prove that they can read that email. ## Impact An unauthenticated attacker who knows a user's email address can get a normal session for that user, with all of that account's permissions. They need no access to the mailbox, and they do not need to sign in with the OAuth provider or complete an OAuth callback. If Magic Link sign-up is enabled and no user has the email address, the attacker can instead create an account that Better Auth wrongly marks as email verified, and is signed in to ",
    "evidence": "osv:GHSA-965c-763c-88jm",
    "products": [
      {
        "name": {
          "value": "better-auth",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.7.7",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "GHSA-965c-763c-88jm",
      "aliases": [
        "CVE-2026-110862",
        "CVE-2026-114607",
        "GHSA-965c-763c-88jm"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "1.4.0-beta.18"
                },
                {
                  "fixed": "1.7.7"
                }
              ]
            }
          ],
          "package": {
            "name": "better-auth",
            "purl": "pkg:npm/better-auth",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-965c-763c-88jm/GHSA-965c-763c-88jm.json"
          }
        }
      ],
      "modified": "2026-10-27T15:47:24.136972170Z",
      "provider": "osv",
      "references": [
        "https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-114607",
        "https://github.com/better-auth/better-auth/pull/11494",
        "https://github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a",
        "https://github.com/better-auth/better-auth",
        "https://github.com/better-auth/better-auth/releases/tag/v1.7.7"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-287"
        ],
        "severity": "CRITICAL",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-22T17:16:58Z",
        "github_reviewed_at": "2026-10-27T15:32:05Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-110862",
        "evidence": "/aliases"
      },
      {
        "value": "CVE-2026-114607",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 462839,
  "published_at": "2026-10-27T15:32:05+00:00"
}