Better Auth OAuth Proxy Bypass Lets Attackers Forge User Profiles
Unauthenticated attackers can hijack accounts in Better Auth versions before 1.7.7 by exploiting a flaw in the OAuth Proxy plugin that permits profile forgery.
Key points
- CVE-2026-110864 is rated 9.1 (Critical) by the National Vulnerability Database.
- The flaw allows unauthenticated users to sign in as others via forged encrypted profiles.
- Versions from 1.5.0-beta.12 up to, but not including, 1.7.7 are affected.
Better Auth contains an authentication bypass flaw in its OAuth Proxy plugin that allows unauthenticated attackers to take over user accounts by forging encrypted profiles, according to the National Vulnerability Database.
Root cause
The vulnerability, tracked as CVE-2026-110864, stems from insufficient verification within the OAuth Proxy component. The flaw is classified under CWE-287, indicating an improper authentication mechanism. It exists in Better Auth versions ranging from 1.5.0-beta.12 through any release prior to 1.7.7. The National Vulnerability Database assigns a CVSS score of 9.1, marking the issue as critical severity.
Attack path
An attacker does not need valid credentials to exploit this weakness. By manipulating the proxy when it shares a global secret and relies on cookie-stored state, an adversary can generate an encrypted state for a fabricated profile. This fake profile includes a victim's verified email address. The system then performs implicit linking, effectively granting the attacker access to the target user's account without authentication.
Affected versions
- Better Auth 1.5.0-beta.12
- All subsequent releases before 1.7.7
Mitigation
- Upgrade to Better Auth version 1.7.7 or later.
- Review OAuth Proxy configurations for shared global secrets.
- Audit cookie-stored state handling for implicit linking risks.
Why it matters
Understanding this flaw requires grasping how trust is established in modern web applications. OAuth proxies act as intermediaries, verifying user identity from external providers. When a proxy trusts encrypted data without rigorous validation, it creates a blind spot. Attackers exploit this by crafting falsified data that the system accepts as legitimate. Teams usually monitor for anomalous login patterns, but bypassing authentication entirely makes detection difficult. Check whether your infrastructure relies on similar implicit linking mechanisms, as they often assume the integrity of encrypted tokens without re-verifying the sender's identity at each step.
Background: National Vulnerability Database
The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.
Read the full guide: National Vulnerability Database: Small Business Action Plan
What to do and how to stay safe: Better Auth
- Verify which version of Better Auth your applications currently run.
- Inspect logs for unexpected account access or profile changes.
- Monitor for unusual OAuth token exchanges or state cookies.
- Wait for official vendor guidance before altering core security settings.
Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-110864.
What is the severity rating?
The National Vulnerability Database rates it as 9.1, which is critical.
Which versions are vulnerable?
Better Auth versions from 1.5.0-beta.12 before 1.7.7 are affected.
