VulnerabilityPublished 27 Oct 2026

better-auth: OAuth Proxy lets an attacker sign in as another user

Affects better-authSource GCVE Database

CVSS 7.4 High : upgrade to 1.7.7 soon.

Data as of 27 Oct 2026, 16:27 UTC

CVSS 3.1 base score

7.4High

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 1.7.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Upgrade better-auth to 1.7.7.

Affected software

Product	Affected	Fixed in
npmbetter-auth	Affected >=1.5.0-beta.12 <1.7.7	Fixed in 1.7.7

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

## Am I affected? You may be affected if you use `better-auth` from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated `secret`, or its `secret` equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie (`account.storeStateStrategy: "cookie"`). With a database or secondary storage, this is only the case if you chose it explicitly. - Implicit account linking is on (the default). You are not affected by this path if every participating environment uses a proxy `secret` distinct from its global Better Auth secret, if sign-in state is stored in the database, or if you use a version before 1.5.0-beta.12. ## Summary The OAuth Proxy plugin trusts any user profile it can decrypt. In the affected setup, Better Auth encrypts sign-in state, including data the caller chose, with the same secret and hands it to anyone who starts a social sign-in. An attacker can use this to get a fake profile for another user's email address that the proxy accepts as real. ## Impact An attacker without an account who knows a user's verified email address can sign in as that user, with that user's permissions. They can read private data, change the account, and link a provider account of their choice to it. They need no provider sign-in and no action from the victim. No availability impact is established, and a reported open redirect was not confirmed. ## Patches The fix is merged for the planned `better-auth` 1.7.7 release. That package is not available yet. Upgrade all nodes handling the same cookie-backed OAuth or SAML state flow and all OAuth Proxy participants together, including the production coordinator and preview or development deployments. Keep installed Better Auth packages released alongside `better-auth` on the same release version. Restart pending sign-in and account-linking flows; pre-upgrade state cookies and proxy payloads are rejected. Public options and API signatures are unchanged. ## Workarounds Until you upgrade to the fixed release, apply one of these: - Set one strong OAuth Proxy `secret` across every environment that takes part in the proxy flow, and keep it different from each environment's global Better Auth secret. - Set `account.storeStateStrategy: "database"`. This is already the default when a database or secondary storage is configured. If Magic Link is also enabled, switching can expose a separate cross-purpose verification-record path in affected releases. Ensure the two flows resolve to distinct stored identifiers; with built-in options, use Magic Link `storeToken: "hashed"` with global `verification.storeIdentifier` unset or `"plain"`, or disable Magic Link or both built-in social and Generic OAuth sign-in. - Remove the OAuth Proxy plugin if you do not need it. Setting `account.accountLinking.disableImplicitLinking: true` stops this path from taking over an existing account. It does not fix the underlying flaw: the callback can still accept attacker-made data as a provider identity. Apply one of the steps above as well.

CWE-287Improper Authentication (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
V9.2.3 (opens in a new tab)
Attack patterns
Fake the Source of Data (opens in a new tab)
Utilizing REST's Trust in the System Resource to Obtain Sensitive Data (opens in a new tab)
Session Hijacking (opens in a new tab)
Token Impersonation (opens in a new tab)
Upload a Web Shell to a Web Server (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-345Insufficient Verification of Data Authenticity (opens in a new tab)
Class weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
JSON Hijacking (aka JavaScript Hijacking) (opens in a new tab)
Cache Poisoning (opens in a new tab)
DNS Cache Poisoning (opens in a new tab)
Spoofing of UDDI/ebXML Messages (opens in a new tab)
Application API Message Manipulation via Man-in-the-Middle (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

WeaknessesCWE-287, CWE-345

Technical details

References

Community reviews

Related threats