Update Better Auth to 1.7.7 to Fix Critical Login Bypass Flaw
Attackers can hijack accounts in Better Auth versions before 1.7.7 by swapping OAuth tokens for magic links, allowing them to log in as any user.
Key points
- Better Auth versions 1.4.0-beta.18 through 1.7.6 contain a critical authentication bypass vulnerability.
- The flaw allows unauthenticated attackers to sign in as other users by reusing OAuth state values.
- National Vulnerability Database rates the issue at CVSS 9.3, the highest severity level.
Better Auth has a serious security flaw that lets attackers log in as other people without permission. The problem exists in versions released between 1.4.0-beta.18 and 1.7.6. Attackers can trick the system into accepting their login attempts by mixing up two different types of security checks. This allows them to take over accounts or create fake ones that appear to be verified.
In plain English
To understand the risk, you need to know how the system handles logins. Better Auth supports two common ways to prove identity: OAuth and magic links. OAuth uses a third-party service, like Google, to verify who you are. Magic links send a special code to your email. The vulnerability occurs because the system treats the security token from OAuth the same as the verification code from a magic link. An attacker can start an OAuth login for a victim, grab the temporary token, and submit it as if it were a magic link code. The system accepts it, granting the attacker full access to the victim's account.
The background
The National Vulnerability Database assigned CVE-2026-110862 to this issue. It rates the vulnerability as critical with a CVSS score of 9.3. The weakness is classified under CWE-287, which covers improper authentication. According to the NVD record, the flaw allows unauthenticated attackers to sign in as other users. They can gain active sessions or create accounts that the system mistakenly marks as email-verified. This mirrors the kind of authentication bypass seen in other systems, such as the IBM WebSphere Liberty gRPC flaw Vector Update reported on 2026-10-13, where security checks were circumvented.
What changes now
Developers using Better Auth must update to version 1.7.7 or later. Versions before 1.7.7 are vulnerable. If you cannot update immediately, you should restrict access to the login endpoints. Monitor for unusual login activity, especially from users who have not recently logged in. Check for accounts that were created or verified without standard email confirmation. The vendor has released a fix, but older versions remain at risk until patched.
Key terms explained
Authentication is the process of proving your identity to a system. OAuth is a standard that lets you log in using another service, like a social media account. Magic links are temporary URLs sent via email that grant access when clicked. State values are temporary data used to prevent tampering during login. Teams usually separate these mechanisms to ensure one cannot substitute for the other. Check whether your system validates tokens strictly for their intended purpose. Ensure that login flows do not mix data from different authentication methods.
Background: OAuth
OAuth is an authorization framework that grants third-party apps limited access to data without sharing credentials. OIDC is an identity layer built on OAuth that allows you to verify exactly who a user is. You use OAuth to access data and OIDC to log in.
Read the full guide: OAuth vs OIDC: The Structural Difference for Secure Identity
What to do and how to stay safe: Better Auth
- Update Better Auth to version 1.7.7 or later as soon as possible to close the authentication bypass.
- Review recent login logs for accounts that show unusual activity or unexpected email verification events.
- Restrict network access to login endpoints if you cannot update immediately, limiting exposure to external attackers.
- Monitor for new accounts created with verified email status without corresponding manual verification steps.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Better Auth are affected?
Versions from 1.4.0-beta.18 up to, but not including, 1.7.7 are vulnerable to this authentication bypass.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-110862 as critical with a CVSS score of 9.3.
Can attackers create fake accounts with this flaw?
Yes, attackers can create accounts that the system incorrectly marks as having verified email addresses.
