CVE-2026-114607 better-auth CVE debrief

Who should care

Defenders responsible for better-auth library configurations and deployments should assess exposure and verify their versions to prevent unauthorized access. This includes reviewing OAuth provider and Magic Link settings, and updating to version 1.7.7 or later. Security teams should prioritize verifying their better-auth library versions and configurations to prevent unauthorized access.

Why it matters

CVE-2026-114607 is a critical vulnerability in better-auth that allows an attacker to sign in as another user. Defenders should verify their configurations and update to version 1.7.7 or later.

• Potential unauthorized access to user accounts
• Possible creation of incorrectly marked email-verified accounts
• Required verification of better-auth library versions and configurations
• Necessity to update to version 1.7.7 or later

Technical summary

The better-auth library for TypeScript has a critical vulnerability, CVE-2026-114607, allowing an unauthenticated attacker to sign in as another user using OAuth state as a Magic Link token. This occurs in versions 1.4.0-beta.18 to 1.7.6 with specific configurations of Magic Link and OAuth providers. The issue is fixed in version 1.7.7. The vulnerability impacts deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, and use account.storeStateStrategy set to database.

Defensive priority

Defenders should prioritize verifying their better-auth library versions and configurations to prevent unauthorized access.

Recommended defensive actions

• Verify better-auth library version and configuration
• Update to version 1.7.7 or later
• Review OAuth provider and Magic Link settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed version. The better-auth library for TypeScript has a critical vulnerability, CVE-2026-114607, allowing an unauthenticated attacker to sign in as another user using OAuth state as a Magic Link token. This occurs in versions 1.4.0-beta.18 to 1.7.6 with specific configurations of Magic Link and OAuth providers. The issue is fixed in version 1.7.7. There is no indication of public exploitation, but defenders should verify their better-auth

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.