The vulnerability in better-auth before version 1.6.11 involves the OAuth callback's auto-linking mechanism in handleOAuthUserInfo, which implicitly links an OAuth identity to a local user account if the OAuth provider asserts email_verified: true, without checking the local user's emailVerified flag. An attacker can pre-register a victim's email with emailVerified: false and later cause the victim's OAuth login to link to the attacker's account, effectively hijacking the victim's account by combining password and OAuth logins. The local emailVerified flag is then promoted to true post-link, defeating mitigations like requireEmailVerification: true. The fix adds a local-side check to reject implicit linking if the local email is unverified. Workarounds include disabling implicit linking or disabling account linking entirely, though these impact user experience. The vulnerability affects all OAuth and SSO providers integrated with better-auth that call handleOAuthUserInfo.

This vulnerability enables account takeover through pre-account hijacking by allowing an attacker to bind a victim's OAuth identity to the attacker's pre-registered password login account, granting persistent access. It bypasses the requireEmailVerification setting by promoting the attacker's unverified email to verified after linking. The issue affects all OAuth and SSO sign-in flows using better-auth's handleOAuthUserInfo, potentially compromising user accounts and authentication integrity.

A fix is available in better-auth version 1.6.11 and later, which adds a local email verification check before implicit OAuth account linking. Users should upgrade to version 1.6.11 or later. If immediate upgrade is not possible, developers can mitigate by disabling implicit linking via account.accountLinking.disableImplicitLinking: true, forcing explicit linking through authenticated endpoints, or by disabling account linking entirely with account.accountLinking.enabled: false, though this breaks multi-login-method UX. The requireEmailVerification setting alone does not mitigate this vulnerability.