The vulnerability in better-auth affects versions >=1.1.3 <1.6.22 and pre-release versions >=1.7.0-beta.0 <1.7.0-beta.10. It enables an attacker to hijack accounts by registering with the victim's email and a password before the victim verifies the account. When the victim later authenticates via passwordless methods (magic-link or email-OTP), the system marks the account as verified but does not remove the attacker's password or revoke existing sessions. This flaw allows the attacker to maintain persistent access to the victim's account. The vulnerability is tracked as CVE-2026-67327 with a CVSS 3.1 score of 8.3 (high severity). It is fixed in versions 1.6.22 and 1.7.0-beta.10.

Successful exploitation results in account takeover, allowing an attacker to gain persistent unauthorized access to user accounts. The attacker’s password remains valid even after the legitimate user verifies the account via passwordless sign-in, compromising confidentiality, integrity, and availability of the affected accounts.

Upgrade affected better-auth versions to 1.6.22 or later, or to 1.7.0-beta.10 or later for pre-release versions. These versions contain the official fix that removes the vulnerability. No other mitigation is indicated by the vendor advisory.