PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53516 better-auth CVE debrief

CVE-2026-53516 is a HIGH severity vulnerability in Better Auth, an authentication and authorization library for TypeScript. Prior to version 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true. This allows an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.

Vendor
better-auth
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-15
Original CVE updated
2026-07-21
Advisory published
2026-07-15
Advisory updated
2026-07-21

Who should care

Users of Better Auth library for TypeScript, especially those using OAuth callback auto-link gate in handleOAuthUserInfo, should be aware of this vulnerability and take steps to upgrade to version 1.6.11 or later.

Technical summary

The vulnerability in Better Auth's OAuth callback auto-link gate allows an attacker to bind a victim's OAuth identity to the attacker's account by exploiting the implicit account linking feature. This is possible when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true. The issue arises because the library does not enforce a stricter verification process, potentially leading to unauthorized account access. To mitigate this, users should upgrade to version 1.6.11 or later of the Better Auth library. Additionally, reviewing and updating any affected applications that use Better Auth's OAuth callback auto-link gate is crucial. This involves assessing the current implementation and ensuring that it aligns with the latest security guidelines.

Defensive priority

High priority should be given to upgrading to version 1.6.11 or later, as well as reviewing and updating any affected applications that use Better Auth's OAuth callback auto-link gate.

Recommended defensive actions

  • Upgrade to version 1.6.11 or later of Better Auth library
  • Review and update any affected applications that use Better Auth's OAuth callback auto-link gate
  • Monitor for any suspicious activity related to OAuth callback auto-link gate
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-15T18:16:47.967Z and was last modified on 2026-07-21T14:14:22.307Z. The NVD entry is currently Analyzed. The vulnerability was identified in Better Auth, an authentication and authorization library for TypeScript, specifically in its OAuth callback auto-link gate. The issue allows for implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user's emailVerified field to also be true. This could lead to an attacker binding a victim's OAuth identity to their account if the victim's email has been pre-registered. The library's handling of email verification during the OAuth callback process is a critical point of vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-15T18:16:47.967Z and has not been modified since then. The NVD entry is currently Analyzed.