Is CVE-2026-110864 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110864 being exploited in the wild.

How severe is CVE-2026-110864?

High severity, with a CVSS score of 7.4, published 14 October 2026.

Which products and versions are affected?

Better-Auth 1.5.0-beta.12 through 1.7.6; better-auth (npm) SEMVER:introduced=1.5.0-beta.12,fixed=1.7.7.

How is CVE-2026-110864 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110864?

Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110864: Better Auth OAuth Proxy authentication bypass

CVE-2026-110864 · Severity: high · CVSS 7.4 · Published 2026-10-14

Better Auth is an authentication library that supports OAuth sign-in and account linking. A flaw in the OAuth Proxy plugin allows unauthenticated attackers to forge encrypted authentication state and sign in as any other user, gaining full access to their account and data without the victim's knowledge or action.

Technologies: Better-Auth, better-auth (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-110864 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110864 being exploited in the wild.
How severe is CVE-2026-110864?: High severity, with a CVSS score of 7.4, published 14 October 2026.
Which products and versions are affected?: Better-Auth 1.5.0-beta.12 through 1.7.6; better-auth (npm) SEMVER:introduced=1.5.0-beta.12,fixed=1.7.7.
Is there a fix for CVE-2026-110864?: Yes. better-auth (npm): upgrade to 1.7.7 or later. Until then: Until upgrading, set a unique OAuth Proxy secret distinct from the global Better Auth secret, switch sign-in state storage to database mode, disable implicit account linking with account.accountLinking.disableImplicitLinking: true, or remove the OAuth Proxy plugin if not needed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110864 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110864?: Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.7.7 or later
```
npm install better-auth@1.7.7
```

Until upgrading, set a unique OAuth Proxy secret distinct from the global Better Auth secret, switch sign-in state storage to database mode, disable implicit account linking with account.accountLinking.disableImplicitLinking: true, or remove the OAuth Proxy plugin if not needed.

Technical details

The OAuth Proxy plugin trusts any decrypted user profile it receives. When the proxy shares the global encryption secret and sign-in state is stored in cookies (rather than the database), an attacker can craft a fake encrypted profile with a victim's verified email address, which the proxy accepts as legitimate during implicit account linking. This requires the OAuth Proxy to lack a dedicated secret distinct from the global Better Auth secret, and implicit linking to be enabled (the default).

Affected products

Better Auth Better Auth 1.5.0-beta.12 through 1.7.6

Identifiers

CVE-2026-110864
GHSA-r4xp-prcw-77qf

Timeline

2026-09-30: disclosed
2026-10-14: advisory
2026: patched: version 1.7.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.