Threats tagged 'ghsa-965c-763c-88jm'

A critical vulnerability in better-auth versions from 1.4.0-beta.18 up to but not including 1.7.7 allows an unauthenticated attacker to use the OAuth state value as a Magic Link token to sign in as any user by knowing only their email address. This bypasses email verification and OAuth provider authentication, granting full session access. The flaw affects configurations using Magic Link with default or hashed token storage combined with social or Generic OAuth sign-in and database-backed OAuth state storage. The issue is fixed in version 1.7.7.