The vulnerability in better-auth prior to version 1.6.2 involves a failure to validate the OAuth state parameter against the stored nonce when cookie-backed state storage is used without PKCE. This improper validation enables attackers to forge the state parameter and supply an attacker-controlled authorization code, which can result in authenticated sessions bound to the attacker’s external identity or persistent linkage of attacker accounts to victim profiles. The issue is categorized under CWE-287 (Improper Authentication) and has a CVSS 3.1 base score of 5.3 (medium severity). There are no known exploits in the wild and no patch links or vendor advisories currently provided.

An attacker exploiting this vulnerability can bypass proper OAuth state validation, allowing them to create authenticated sessions associated with their own external identity or link attacker-controlled accounts to victim profiles. This compromises the integrity of the authentication process, potentially leading to unauthorized access or account linkage. There is no indication of confidentiality or availability impact, and no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor for vendor updates and consider implementing PKCE (Proof Key for Code Exchange) if supported, as the vulnerability specifically affects cookie-backed state storage without PKCE. Avoid using vulnerable versions of better-auth until a fix is confirmed.