CRITICAL 9.1 NVD
CVE-2026-110864
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to s
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf
- https://www.vulncheck.com/advisories/better-auth-1.5.0-beta.12-before-1.7.7-authentication
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-10-14 via NVD.
Risk Timeline
CVE Disclosed2026-10-14 · 0 days ago
Remediation Resources
vulnfeed aggregates 15100 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.