CVE-2026-114607: better-auth: OAuth state can be used as a Magic Link to sign in as another user
Better Auth accepts an OAuth sign-in state value as a Magic Link token. An attacker can start an OAuth sign-in with any email address and use the returned state value to finish a Magic Link sign-in for that address. They never prove that they can read that email.
References
- github.com/advisories/GHSA-965c-763c-88jm
- github.com/better-auth/better-auth/commit/ac54bfd67821a7607533af2059858b12bc54e26a
- github.com/better-auth/better-auth/pull/11494
- github.com/better-auth/better-auth/releases/tag/v1.7.7
- github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm
- nvd.nist.gov/vuln/detail/CVE-2026-114607
Code Behaviors & Features
Detect and mitigate CVE-2026-114607 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →