Answer in brief
CVE-2026-114607 records a Critical severity (CVSS 9.1) vulnerability in better-auth: OAuth state can be used as a Magic Link to sign in as another user. The current sources do not mark it as known exploited. The current feed maps better-auth/better-auth (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps better-auth/better-auth (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| better-auth/better-authgeneric | >=1.4.0-beta.18 <1.7.7 | 1.7.7 |
Published upstream
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 22, 2026
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
Quoted source text, attributed separately from HOL analysis.