GHSA-r4xp-prcw-77qf: better-auth: OAuth Proxy lets an attacker sign in as another user

The OAuth Proxy plugin trusts any user profile it can decrypt. In the affected setup, Better Auth encrypts sign-in state, including data the caller chose, with the same secret and hands it to anyone who starts a social sign-in. An attacker can use this to get a fake profile for another user’s email address that the proxy accepts as real.