Advisory · CVE-2026-110864
Better Auth OAuth Proxy flaw can forge profiles for account takeover
Better Auth from 1.5.0-beta.12 before 1.7.7 has an OAuth Proxy authentication bypass when the proxy shares the global secret and cookie-stored state is used. CVSS 4.0 9.1.
- Vendor
- Better Auth
- Product
- Better Auth
- Identifier / CWE
- CVE-2026-110864
CWE-287 - Action timing
- Immediate
Explain it like I’m five
A forged encrypted note about who you are is trusted as proof, so the system links it straight to a real account.
- 01Conditions in place
The OAuth Proxy plugin shares the global secret and cookie-stored state is in use.
- 02Encrypted state obtained
An unauthenticated attacker obtains encrypted state for a fake profile.
- 03Victim email claimed
That profile carries a victim verified email address.
- 04Implicit linking takes over
The fake profile is linked implicitly and the attacker gains the victim account.
What happened
The GitHub advisory for Better Auth describes an authentication bypass in the OAuth Proxy plugin in releases from 1.5.0-beta.12 before 1.7.7. The described conditions are a proxy that shares the global secret together with cookie-stored state.
Under those conditions an unauthenticated attacker can use a forged encrypted profile carrying a victim verified email address and take over the account through implicit linking.
What to do
- Inventory applications using Better Auth with the OAuth Proxy plugin.
- Upgrade Better Auth to 1.7.7 or later using the project advisory guidance.
- Until patched, review proxy secret sharing and cookie-stored state configuration against the advisory conditions.
- Review account linking events and sign-ins for profiles linked by email without a normal verified flow.
- Invalidate affected sessions, unlink suspicious linked profiles, and rotate exposed secrets where abuse cannot be ruled out.
Management note
The conditions are specific, so inventory accuracy matters here. Where the proxy pattern matches the advisory, treat this as critical despite the lower CVSS 3.1 score, and audit links created during the window.