Better Auth 1.7.7 patches critical CVE-2026-110864 flaw enabling OAuth proxy account hijacking

Better Auth has released version 1.7.7 to address a critical authentication bypass vulnerability identified as CVE-2026-110864. This update resolves a flaw in the OAuth Proxy plugin that allowed unauthenticated attackers to hijack user accounts by forging encrypted profiles.

What happened

The vulnerability exists in Better Auth versions ranging from 1.5.0-beta.12 up to but not including 1.7.7, according to the National Vulnerability Database. The flaw is classified as a critical severity issue with a CVSS score of 9.1. It stems from weaknesses in how the OAuth Proxy plugin handles authentication tokens and user state.

Attackers can exploit this issue to sign in as other users without valid credentials. The attack vector involves forging encrypted profiles that mimic legitimate user data. This bypasses the standard authentication checks required for account access.

Why it matters

The risk is highest when the proxy shares a global secret and uses cookie-stored state. Under these conditions, attackers can obtain encrypted state data for a fake profile. They then use this data to link the fake profile to a victim's verified email address.

This process results in implicit account linking, effectively handing control of the victim's account to the attacker. The vulnerability is categorized under CWE-287, indicating a failure in authentication mechanisms. Any system using the affected versions of Better Auth is potentially exposed to this takeover method.

What to watch

• Monitor vendor communications for any additional patches or security advisories related to CVE-2026-110864.
• Check application logs for unusual authentication attempts or profile changes that may indicate exploitation.
• Verify that all instances of Better Auth have been updated to version 1.7.7 or later.
• Review OAuth proxy configurations to ensure they do not share global secrets unnecessarily.

Who needs to act first

Teams should prioritize updating systems that expose the OAuth Proxy plugin to untrusted networks. Public-facing applications require immediate attention because they present a larger attack surface to potential adversaries. Before applying the patch, verify that the update does not break existing integrations or workflows. Conduct thorough testing in a non-production environment to ensure stability. Back up configuration files and databases before making changes to facilitate quick recovery if issues arise.

Background: OAuth

OAuth is a protocol for granting limited access to resources without sharing credentials. SSO is a pattern that lets users access multiple apps with one login. They solve different problems: OAuth handles authorization, while SSO handles authentication and session management.

Read the full guide: OAuth vs SSO: How to Choose the Right Identity Protocol

What to do and how to stay safe: Better Auth

• Update all instances of Better Auth to version 1.7.7 or newer to resolve the authentication bypass.
• Audit current OAuth proxy configurations to identify systems using shared global secrets.
• Review access logs for signs of unauthorized account access or suspicious profile modifications.
• Implement additional monitoring for anomalous authentication patterns during the transition period.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Better Auth are affected by CVE-2026-110864?

Versions from 1.5.0-beta.12 through 1.7.6 are affected by this critical vulnerability.

Is there a fix available for this authentication bypass?

Yes, the vendor has released version 1.7.7 to address the flaw.

How does the attacker exploit this vulnerability?

Attackers forge encrypted profiles to bypass authentication and link to victim accounts via implicit linking.