Better Auth 1.7.7 patch fixes critical OAuth session hijacking flaw

Better Auth has released version 1.7.7 to address a critical authentication bypass vulnerability. The flaw, tracked as CVE-2026-114607, allows attackers to hijack sessions or create verified accounts by exploiting specific Magic Link and OAuth configurations.

What happened

The National Vulnerability Database rates CVE-2026-114607 as critical with a CVSS score of 9.1. The issue affects the Better Auth TypeScript library in versions ranging from 1.4.0-beta.18 up to, but not including, 1.7.7. The vulnerability exists within the library's handling of Magic Link verification and OAuth state storage.

According to the NVD record, the flaw arises when deployments enable Magic Link with specific token storage settings. This includes cases where storeToken is set to plain, or where it is set to hashed while the global verification.storeIdentifier is also hashed. The issue requires the deployment to use a built-in social or Generic OAuth provider and set account.storeStateStrategy to database.

These specific configurations cause Magic Link verification records and OAuth state values to resolve to the same stored identifier. An unauthenticated attacker can initiate an OAuth sign-in for a known email address. The attacker can then redeem the returned OAuth state through the Magic Link flow without controlling the target's mailbox or completing the provider callback.

This manipulation allows the attacker to obtain a normal session for an existing user. If sign-up is enabled, the attacker can create a new account that is incorrectly marked as email verified. The vendor has addressed this issue in the release of version 1.7.7.

Why it matters

The weakness is classified under CWE-287, indicating an improper authentication mechanism. The ability to bypass email verification and gain access to existing sessions undermines the core security model of the application. Attackers do not need to compromise the user's email account to gain access.

This flaw affects systems that rely on the combination of Magic Link and OAuth providers. The specific configuration requirements narrow the attack surface but still leave many standard deployments vulnerable. The critical rating reflects the ease of exploitation and the severe impact of session hijacking.

What to watch

• Monitor internal logs for unusual OAuth initiation patterns followed by Magic Link verification.
• Check for new accounts that were created without standard email confirmation steps.
• Look for session tokens that appear to originate from unexpected OAuth providers.
• Review configuration files for the specific storeToken and storeStateStrategy settings mentioned in the advisory.

Who needs to act first

Teams should prioritize systems that expose public-facing login pages combining Magic Link and OAuth features. Identify any environments using the specific configuration settings that trigger this flaw. Back up current application states before applying updates to ensure rollback capability. Test the patch in a staging environment to verify that authentication flows remain stable. Roll out the fix to production systems with the highest external exposure first.

Background: OAuth

OAuth is a protocol for granting limited access to resources without sharing credentials. SSO is a pattern that lets users access multiple apps with one login. They solve different problems: OAuth handles authorization, while SSO handles authentication and session management.

Read the full guide: OAuth vs SSO: How to Choose the Right Identity Protocol

What to do and how to stay safe: Better Auth

• Review your Better Auth version to determine if it falls within the affected range of 1.4.0-beta.18 to 1.7.7.
• Verify if your deployment uses the combination of Magic Link, OAuth providers, and database state storage.
• Update to version 1.7.7 once the vendor provides an update to mitigate the authentication bypass.
• Audit recent login activity for signs of unauthorized session creation or new verified accounts.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Better Auth are affected by this vulnerability?

Versions from 1.4.0-beta.18 until 1.7.7 are affected by CVE-2026-114607.

Is there a fix available for this critical flaw?

Yes, the issue is fixed in version 1.7.7 of the Better Auth library.

What specific configurations trigger this vulnerability?

The flaw requires Magic Link with plain or hashed token storage, OAuth providers, and database state strategy settings.