A vulnerability in better-auth versions from 1.5.0-beta.12 up to but not including 1.7.7 with the OAuth Proxy plugin allows an attacker to sign in as another user if certain conditions are met. The issue arises when the OAuth Proxy plugin shares the same secret as the global Better Auth secret, sign-in state is stored in a cookie, and implicit account linking is enabled. An attacker who knows a user's verified email can impersonate that user without needing provider sign-in or victim interaction. The flaw is fixed in version 1.7.7.