Executive brief
Better Auth is an authentication library used by applications to manage user sign-up and login flows. In configurations that support both passwordless login (magic-link or email-OTP) and traditional email/password registration, an attacker can pre-register an account using a victim's email address. When the victim later signs in via the passwordless flow, their action inadvertently unlocks the attacker's pre-planted password, allowing the attacker to maintain account access alongside the legitimate owner. This enables data theft, unauthorized modifications, and account lockout.
Technical details
This is a pre-account hijacking vulnerability affecting magic-link and email-OTP authentication flows in Better Auth. The root cause is insufficient credential revocation: when passwordless login confirms email ownership on an account that was never email-verified, the library fails to remove unverified passwords and revoke prior sessions set during the unverified state. An attacker exploits this by registering with open registration using the victim's email and a chosen password, leaving the account unverified. When the legitimate user proves email ownership via magic-link or email-OTP, the account becomes verified and the attacker's password remains active. The attack requires user interaction (victim signing in via passwordless flow) but no privileges, spreads over the network, and affects only systems with both features enabled and open email/password registration. Fixed versions remove unproven credentials and revoke sessions before marking the account verified.
Affected products
- Better Auth Better Auth 1.1.3 to 1.6.21; 1.7.0-beta.0 to 1.7.0-beta.9
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Patches released: 1.6.22 and 1.7.0-beta.10