CVE-2026-110864 in Better Auth
Summary
by MITRE • 10/15/2026
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within Better Auth versions prior to 1.7.7 represents a critical authentication bypass flaw located specifically in the OAuth Proxy plugin implementation. This security defect arises from an improper handling of encrypted profile data and session state management, allowing unauthenticated actors to manipulate the authentication flow. The core issue stems from the architectural decision where the proxy shares a global secret used for encrypting user profiles and managing cookie-stored states. When this configuration is active, particularly in environments relying on implicit linking mechanisms that associate accounts based on verified email addresses rather than explicit provider bindings, the system fails to adequately validate the integrity of the encrypted payload presented during the login process.
From a technical perspective, the flaw enables attackers to forge encrypted profiles containing arbitrary user data. By exploiting the shared global secret, an attacker can generate valid-looking encryption tokens for fake profiles that include the verified email address of a target victim. Because the authentication mechanism relies on implicit linking based on these emails, the system accepts the forged profile as legitimate and associates it with the existing account linked to that email address. This effectively allows the attacker to bypass standard OAuth verification steps and gain unauthorized access to the victim's session without possessing valid credentials or completing the full provider-specific authorization flow.
The operational impact of this vulnerability is severe, leading directly to complete account takeover for any user whose email address has been verified within the application. An unauthenticated remote attacker can exploit this condition over a network connection, requiring no prior access or privileges. The ability to sign in as other users compromises the confidentiality and integrity of user data, potentially exposing sensitive personal information, financial records, or proprietary business details depending on the nature of the affected accounts. This type of attack undermines trust in the authentication infrastructure and can lead to significant reputational damage and regulatory non-compliance for organizations relying on this framework.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically illustrating a failure to correctly verify identity before granting access. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages legitimate account attributes (the victim's email) to impersonate an authorized user. It also reflects aspects of CWE-345, Insufficient Verification of Data Authenticity, due to the successful forgery of encrypted profile data that the system fails to reject despite its malicious origin.
To mitigate this risk, organizations must immediately upgrade Better Auth to version 1.7.7 or later where these cryptographic and state management flaws have been addressed. In environments where upgrading is not instantly feasible, administrators should review their OAuth Proxy configurations to ensure that shared global secrets are rotated frequently and consider disabling cookie-stored states if they are not strictly necessary for the application's functionality. Implementing strict validation of encrypted profile payloads against known legitimate structures can also help reduce exposure. Additionally, shifting from implicit linking based solely on email verification to explicit provider binding or multi-factor authentication requirements would significantly raise the barrier for attackers attempting to exploit this specific vector. Regular security audits and penetration testing focused on authentication flows are recommended to identify similar weaknesses in custom implementations of OAuth proxies.