Is CVE-2026-114607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114607 being exploited in the wild.

How severe is CVE-2026-114607?

Critical severity, with a CVSS score of 9.1, published 22 October 2026.

Which products and versions are affected?

Better-Auth 1.4.0-beta.18 through 1.7.6; better-auth (npm) >= 1.4.0-beta.18, < 1.7.7.

How is CVE-2026-114607 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114607?

Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114607: Better Auth authentication bypass in Magic Link and OAuth

Q: Is there a fix for CVE-2026-114607?

Yes: fixed in 1.7.7. Until then: Upgrade all Better Auth nodes handling the same cookie-backed OAuth or SAML relay-state flow together and all OAuth Proxy participants in the same cutover, including production and preview or development deployments. Restart all OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows initiated before the upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114607 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114607?

Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114607 · Severity: critical · CVSS 9.1 · Published 2026-10-22

Better Auth is a TypeScript authentication library used to verify user identities and manage login sessions. A critical flaw allows attackers to bypass authentication by exploiting how Magic Links and OAuth state values are stored, enabling account takeover or creation of fake verified accounts without controlling a user's email. The vulnerability affects versions 1.4.0-beta.18 through 1.7.6 when certain configurations are enabled.

Technologies: Better-Auth, better-auth (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-114607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114607 being exploited in the wild.
How severe is CVE-2026-114607?: Critical severity, with a CVSS score of 9.1, published 22 October 2026.
Which products and versions are affected?: Better-Auth 1.4.0-beta.18 through 1.7.6; better-auth (npm) >= 1.4.0-beta.18, < 1.7.7.
Is there a fix for CVE-2026-114607?: Yes: fixed in 1.7.7. Until then: Upgrade all Better Auth nodes handling the same cookie-backed OAuth or SAML relay-state flow together and all OAuth Proxy participants in the same cutover, including production and preview or development deployments. Restart all OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows initiated before the upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114607 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114607?: Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.7.7

Upgrade all Better Auth nodes handling the same cookie-backed OAuth or SAML relay-state flow together and all OAuth Proxy participants in the same cutover, including production and preview or development deployments. Restart all OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows initiated before the upgrade.

Technical details

The vulnerability stems from insufficient isolation between Magic Link verification records and OAuth state storage when specific configurations are combined: Magic Link with storeToken set to plain or hashed, global verification.storeIdentifier set to hashed, social/Generic OAuth providers enabled, and account.storeStateStrategy set to database. An attacker can initiate an OAuth sign-in for a known email address and redeem the returned state value through Magic Link verification without controlling the mailbox or completing the OAuth callback, gaining a normal session or creating an incorrectly email-verified account.

Affected products

Better Auth Better Auth 1.4.0-beta.18 through 1.7.6

Identifiers

CVE-2026-114607
GHSA-965c-763c-88jm

Timeline

2026-10-22: disclosed
2026-09-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.