better-auth: OAuth Proxy lets an attacker sign in as another user

Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: On a participating environment, the OAuth Proxy plugin has no dedicated secret, or its secret equals that environment's global Better Auth secret. Sign-in state is stored in a cookie (account.storeStateStrategy: "cookie"). With a database or secondary storage, this is only the case if you chose it explicitly. Implicit account linking is on (the default). You are not affected by this path if every participating environment uses a proxy secret distinct from its global Better Auth secret, if sign-in state is stored in the database, or if you use a version before 1.5.0-beta.12. Summary The OAuth Proxy plugin trusts any user profile it can decrypt. In the affected setup, Better Auth encrypts sign-in state, including data the caller chose, with the same secret and hands it to anyone who starts a social sign-in. An attacker can use this to get a fake profile for another user's email address that the proxy accepts as real. Impact An attacker without an account who knows a user's verified email address…

curl https://cve.zerocrew.in/api/cve/GHSA-r4xp-prcw-77qf