CVE-2026-110862 is a critical authentication bypass in the Better Auth npm package, versions 1.4.0-beta.18 up to (but not including) 1.7.7. According to the VulnCheck advisory, an unauthenticated attacker can sign in as another user by passing an OAuth state value to Magic Link verification as if it were a token.
What Is It
The flaw is an improper authentication issue (CWE-287) in Better Auth. The advisory describes the attack like this: an attacker starts an OAuth sign-in using the victim's email address. They then send the returned OAuth state value to the Magic Link verification flow, which accepts that state as a valid token. VulnCheck says this can give the attacker a session as the victim, or let them create an account that is falsely marked as email-verified.
VulnCheck disclosed the issue. NVD published it on 2026-10-14, and its status is "Received."
Why It Matters
The CVSS scores are high on both versions of the standard:
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) - CVSS 4.0: 9.3 CRITICAL (VulnCheck, secondary)
The vector rates the attack as network-reachable and low in complexity. It needs no privileges and no action from the victim. Confidentiality and integrity impact are both rated high. If the attack works as described, an attacker who can take over accounts or create falsely verified identities could get past the identity checks an application relies on.
The supplied CISA KEV entry is empty. This CVE does not appear in the KEV catalog, and the supplied data does not confirm active exploitation.
What's Vulnerable
- Package:
better-auth(npm,pkg:npm/better-auth) - Vendor: better-auth
- Affected: 1.4.0-beta.18 up to (but not including) 1.7.7 (semver)
- Unaffected: 1.7.7
Versions outside this range are unaffected by default. The NVD record lists no CPEs.
Patch Status
Version 1.7.7 is listed as unaffected. Teams running Better Auth from 1.4.0-beta.18 onward should upgrade to 1.7.7 or later. Because no KEV entry exists, CISA has set no required action or due date. Check the GitHub security advisory for vendor guidance, especially if your application uses both OAuth sign-in and Magic Link authentication.