Is CVE-2026-114607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114607 being exploited in the wild.

How severe is CVE-2026-114607?

Critical severity, with a CVSS score of 9.1, published 14 October 2026.

Which products and versions are affected?

Better-Auth 1.4.0-beta.18 through 1.7.6; better-auth (npm) SEMVER:introduced=1.4.0-beta.18,fixed=1.7.7.

How is CVE-2026-114607 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114607?

Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114607: Better Auth authentication bypass via OAuth state reuse

CVE-2026-114607 · Severity: critical · CVSS 9.1 · Published 2026-10-14

Better Auth is an authentication library used to implement sign-in features in applications. A critical vulnerability allows attackers to hijack user accounts by reusing OAuth state values as Magic Link tokens, gaining unauthorized access without needing to verify email ownership. Attackers can either take over existing accounts or create falsely verified accounts that bypass security protections.

Technologies: Better-Auth, better-auth (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-114607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114607 being exploited in the wild.
How severe is CVE-2026-114607?: Critical severity, with a CVSS score of 9.1, published 14 October 2026.
Which products and versions are affected?: Better-Auth 1.4.0-beta.18 through 1.7.6; better-auth (npm) SEMVER:introduced=1.4.0-beta.18,fixed=1.7.7.
Is there a fix for CVE-2026-114607?: Yes. better-auth (npm): upgrade to 1.7.7 or later. Until then: Until upgrade, set account.storeStateStrategy to "cookie", or set Magic Link storeToken to "hashed" with global verification.storeIdentifier set to "plain", or disable either Magic Link or OAuth sign-in entirely.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-30"},{"kind":"patched","at":"2026-09-30","note":"Version 1.7.7 released"},{"kind":"advisory","at":"2026-10-14"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114607 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114607?: Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.7.7 or later
```
npm install better-auth@1.7.7
```

Until upgrade, set account.storeStateStrategy to "cookie", or set Magic Link storeToken to "hashed" with global verification.storeIdentifier set to "plain", or disable either Magic Link or OAuth sign-in entirely.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-30"},{"kind":"patched","at":"2026-09-30","note":"Version 1.7.7 released"},{"kind":"advisory","at":"2026-10-14"}]

Technical details

An authentication bypass exists in Better Auth's handling of OAuth and Magic Link flows where OAuth state values can be reused as Magic Link verification tokens. The vulnerability affects Magic Link with database-backed state storage when used alongside OAuth providers, allowing unauthenticated network attackers to complete sign-in for any known email address without email verification. The fix in version 1.7.7 separates the token namespaces to prevent state value reuse.

Affected products

Better Auth Better Auth 1.4.0-beta.18 through 1.7.6

Identifiers

CVE-2026-114607
CVE-2026-110862
GHSA-965c-763c-88jm

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.