better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: Magic Link is enabled with default storeToken: "plain", or with storeToken: "hashed" and global verification.storeIdentifier: "hashed" (including a hashed default). At least one built-in social provider or Generic OAuth provider is enabled. OAuth state uses account.storeStateStrategy: "database", the default when a database or secondary storage is configured. Cookie-backed state blocks this path, subject to the OAuth Proxy condition below. With custom hashers, confirm the flows cannot resolve to the same stored identifier. Summary Better Auth accepts an OAuth sign-in state value as a Magic Link token. An attacker can start an OAuth sign-in with any email address and use the returned state value to finish a Magic Link sign-in for that address. They never prove that they can read that email. Impact An unauthenticated attacker who knows a user's email address can get a normal session for that user, with all of that account's permissions. They need no access to the mailbox,…

curl https://cve.zerocrew.in/api/cve/CVE-2026-114607