Better Auth CSRF in OAuth callback when using cookie storage

Executive brief

Better Auth is an authentication library for web applications. A vulnerability in how it handles OAuth logins allows an attacker to trick a user's browser into linking the victim's account to the attacker's identity. This could allow an attacker to monitor the victim's activity or maintain persistent access to the victim's account.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `parseGenericState` function when `storeStateStrategy` is set to 'cookie'. The implementation decrypted the state cookie but failed to compare the stored nonce against the incoming `state` query parameter. An attacker can exploit this by forcing a victim to submit an attacker-controlled authorization code to the callback URL. If PKCE is disabled, the application will accept the forged state and bind the attacker's external identity to the victim's session or account. This is fixed in version 1.6.2 by ensuring the nonce is stored within the encrypted cookie payload and verified upon callback.

Affected products

• Better Auth better-auth < 1.6.2

Timeline

• 2026-04-09: patched: Fixed via PR #8949
• 2026-05-15: advisory: GitHub Advisory published

References

• https://api.github.com/users/Jvr2022
• https://github.com/Jvr2022
• https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D
• https://api.github.com/users/Jvr2022/repos
• https://avatars.githubusercontent.com/u/109031036?v=4
• https://api.github.com/users/Jvr2022/events%7B/privacy%7D