CVE-2026-110862

Executive Summary

CVE-2026-110862 is a critical authentication bypass in the Better Auth library affecting versions from 1.4.0-beta.18 before 1.7.7. The flaw allows unauthenticated attackers to reuse OAuth state values as Magic Link tokens, enabling sign-in as arbitrary users and the creation of falsely email-verified accounts. With a CVSS score of 9.1, this vulnerability poses a severe risk to any application integrating the affected Better Auth versions, potentially leading to full account takeover and privilege escalation.

Technical Analysis

Better Auth is a TypeScript authentication framework that provides OAuth and Magic Link (passwordless email) sign-in flows. The vulnerability stems from insufficient separation of trust between two distinct authentication artifacts: OAuth state parameters and Magic Link tokens. According to the NVD description, the library fails to validate that a value submitted to the Magic Link verification endpoint originated from a legitimate Magic Link token generation process. Instead, it accepts the OAuth state value—which is generated during an OAuth sign-in initiation—as a valid Magic Link token.

The attack surface is the authentication API, specifically the endpoints handling OAuth initiation and Magic Link verification. An attacker can initiate an OAuth sign-in flow using a victim's email address. The OAuth provider or the library returns a state parameter to the attacker (or the attacker can intercept it). The attacker then submits this state value to the Magic Link verification endpoint. Due to the missing binding between the state parameter and its intended OAuth context, the library treats it as a valid Magic Link token. This results in the issuance of a session for the victim's account or the creation of a new account with the victim's email marked as verified.

The root cause aligns with CWE-287 (Improper Authentication). The CVSS vector indicates network exploitable, low complexity, no privileges required, and no user interaction, with high confidentiality and integrity impact but no availability impact. The scope is unchanged, meaning the vulnerable component and the impacted component are the same.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain is inferred from the vulnerability class and the NVD description. The exploitation steps are as follows:

1. Reconnaissance and target identification: The attacker identifies a web application that uses a vulnerable version of Better Auth (1.4.0-beta.18 to before 1.7.7) by examining HTTP responses, JavaScript bundles, or API endpoints that reference Better Auth or its known authentication routes (e.g., sign-in endpoints for OAuth and Magic Link). The attacker does not need any authenticated access.

2. Initiating OAuth with victim's email: The attacker starts an OAuth sign-in flow by submitting the victim's email address to the application's OAuth initiation endpoint. Because the flow is designed to allow sign-in with an email, the application or the OAuth provider generates and returns an OAuth state value. This state is typically a random string used to prevent CSRF, but in this case, it is not cryptographically bound to a Magic Link purpose.

3. Submitting state as Magic Link token: The attacker captures the returned OAuth state value (either from the HTTP response or by intercepting the redirect) and submits it to the Magic Link verification endpoint. The vulnerable Better Auth implementation does not validate that the token originated from the Magic Link flow. It accepts the OAuth state as a valid Magic Link token, verifying the victim's email and issuing a session cookie or token.

4. Post-exploitation impact: The attacker gains an authenticated session as the victim. If the victim's email is not yet registered, the attacker can create a new account with that email, which is automatically marked as email-verified. This grants the attacker full access to the victim's account, ability to perform actions on their behalf, and potential lateral movement within the application. The high confidentiality and integrity impact reflects the ability to read and modify data as the victim.

Impact Assessment

The CVSS score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N underscores the severity. The attack is network-exploitable, requires no privileges or user interaction, and has low complexity. Successful exploitation results in high confidentiality and integrity impact: attackers can read sensitive data and modify it under the victim's identity. Availability is not directly impacted. The blast radius includes any application using the affected Better Auth versions, potentially exposing all user accounts and any resources accessible to them. Because the flaw allows creation of falsely email-verified accounts, attackers can also bypass email verification requirements, leading to spam, fraud, or further abuse. The lack of a patch increases risk, as no official fix is available, and no workarounds are provided.

Detection Guidance

Sigma Rule

title: Potential Better Auth OAuth State Reuse as Magic Link Token
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects attempts to exploit CVE-2026-110862 by reusing OAuth state values as Magic Link tokens in Better Auth.
author: Security Analyst
date: 2025-04-09
logsource:
  category: web
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path|contains:
      - '/api/auth/magic-link'
      - '/api/auth/verify'
      - '/magic-link/verify'
    cs-uri-query|contains: 'token='
  condition: selection
falsepositives:
  - Legitimate Magic Link sign-ins
level: high
tags:
  - attack.t1078
  - cve.2026.110862

YARA Rule

rule CVE_2026_110862_BetterAuth_OAuth_State_Reuse
{
    meta:
        description = "Detects potential exploitation of CVE-2026-110862 in Better Auth by identifying OAuth state values used as Magic Link tokens in HTTP requests"
        author = "Security Analyst"
        date = "2025-04-09"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110862"
        severity = "critical"
    strings:
        $magic_link_endpoint = "/api/auth/magic-link"
        $verify_endpoint = "/api/auth/verify"
        $token_param = "token="
        $oauth_state = "state="
    condition:
        any of ($magic_link_endpoint, $verify_endpoint) and $token_param and $oauth_state
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110862 Better Auth OAuth State Reuse as Magic Link Token"; flow:to_server,established; content:"POST"; http_method; content:"/api/auth/magic-link"; http_uri; content:"token="; http_uri; content:"state="; http_uri; classtype:attempted-admin; sid:10000001; rev:1; reference:cve,2026-110862;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and http.request.uri : ("/api/auth/magic-link*" or "/api/auth/verify*") and http.request.uri : "*token=*"]
  [http where http.request.method == "POST" and http.request.uri : ("/api/auth/magic-link*" or "/api/auth/verify*") and http.request.uri : "*state=*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search (uri_path="/api/auth/magic-link" OR uri_path="/api/auth/verify") AND method=POST
| rex field=uri_query "(?<token>token=[^&]+)"
| rex field=uri_query "(?<state>state=[^&]+)"
| where isnotnull(token) AND isnotnull(state)
| stats count by src_ip, uri_path, token, state
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100100" level="12">
    <if_sid>31100</if_sid>
    <match>POST /api/auth/magic-link</match>
    <match>token=</match>
    <match>state=</match>
    <description>CVE-2026-110862: Potential Better Auth OAuth state reuse as Magic Link token</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_110862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable the Magic Link authentication feature if it is not essential, or restrict its use to trusted networks.
   • Implement additional validation at the application layer to ensure that OAuth state values and Magic Link tokens are cryptographically bound to their respective flows (e.g., by using distinct, signed tokens with purpose claims).
   • Monitor authentication logs for suspicious patterns, such as multiple failed Magic Link verifications or OAuth state values appearing in Magic Link requests.
   • Apply rate limiting on authentication endpoints to slow down brute-force or automated exploitation attempts.

2. Patch/upgrade steps:

   • No official patch is available. Monitor the Better Auth repository and security advisories for version 1.7.7 or later, which is expected to address the vulnerability. Once released, upgrade immediately.
   • If the library is vendored or forked, backport the fix once available or implement the additional validation described above.

3. Long-term hardening:

   • Adopt secure-by-design principles for authentication flows: ensure that tokens are bound to their intended purpose and cannot be reused across different flows.
   • Conduct regular security reviews and penetration testing of authentication mechanisms.
   • Implement multi-factor authentication (MFA) as an additional layer, although it may not fully mitigate this bypass.
   • Keep dependencies up to date and subscribe to vulnerability feeds for Better Auth.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110862
• Better Auth GitHub repository: https://github.com/better-auth/better-auth (monitor for security advisories)
• CWE-287: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.