CVE-2026-110864

Executive Summary

CVE-2026-110864 is an authentication bypass in the OAuth Proxy plugin of Better Auth, affecting versions from 1.5.0-beta.12 before 1.7.7. When the OAuth proxy is configured to share the global secret and relies on cookie-stored state, an unauthenticated attacker can forge an encrypted profile containing a victim's verified email address and be implicitly linked to that account, resulting in full account takeover. The flaw carries a CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and has no public exploit code or Nuclei template at time of writing.

Technical Analysis

Better Auth is a TypeScript/JavaScript authentication framework that ships an OAuth Proxy plugin intended to relay OAuth flows through an application-controlled proxy. The vulnerable code path is triggered under a specific deployment combination, both conditions of which are stated in the NVD description:

1. The proxy shares the global secret — the OAuth proxy is configured to use the application's global encryption/secret material rather than an isolated, per-proxy secret.
2. Cookie-stored state is used — the OAuth state parameter is persisted in a client-side cookie rather than being bound server-side to the initiating session.

When both conditions hold, the confidentiality of the encrypted state object degenerates: the encryption key is a shared global secret, and the state value is delivered to and accepted from the client. An attacker can therefore construct a fake profile containing the victim's verified email address and wrap it in a state object encrypted with the shared secret — which the server will accept as legitimate.

The core weakness is CWE-287 (Improper Authentication): the identity assertion embedded in the state/profile is trusted without being cryptographically bound to the party that initiated the flow. Because account linkage is implicit, based on the email address carried inside the encrypted profile, the presence of a victim's verified email is sufficient to associate the attacker's flow with the victim's existing account. No password, MFA challenge, or prior session is required, consistent with PR:N and UI:N in the CVSS vector.

The AC:H rating reflects the precondition that the deployment must use the shared global secret and cookie-stored state — an uncommon but supported configuration. The absence of scope change (S:U) and the C:H/I:H/A:N profile describe a direct, high-impact confidentiality and integrity compromise of the target account without availability impact.

No specific function names, class names, endpoints, or file paths beyond "OAuth Proxy plugin" are provided in the available CVE data; further code-level detail of the vulnerable comparison or decryption routine is not available.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the mechanics described in the NVD entry.

1. Reconnaissance / target identification — The attacker identifies a Better Auth deployment running a version in the range 1.5.0-beta.12 to < 1.7.7 that exposes an OAuth-based login and is configured with the OAuth Proxy plugin. Signals include the framework's authentication endpoints and behavior consistent with proxied OAuth (for example http.html:"/api/auth" or framework-specific bootstrapping exposed in the client). The attacker enumerates or otherwise obtains a victim email address with a verified association to the target application.

2. Triggering the flaw class — The attacker initiates the OAuth proxy flow and crafts a state object carrying a forged profile whose email field is set to the victim's verified address. Because the proxy shares the global secret and accepts cookie-stored state, the attacker is able to produce ciphertext that the server will decrypt and trust. The attacker does not need to authenticate and does not need user interaction.

3. Payload / execution (vulnerability-class level) — The attacker submits the forged, correctly-encrypted state to the authentication flow. On processing the state, the application performs implicit linking: it trusts the email in the decrypted profile as proof of identity and binds the flow to the existing account for that email. There is no separate proof that the attacker controls the mailbox or the session that produced the state.

4. Post-exploitation impact — The attacker obtains an authenticated session as the victim, achieving full account takeover. From there the attacker inherits the victim's privileges and data within the application and can pivot to any downstream systems or integrations that trust that identity (SSO-style trust, API tokens, or linked services). Integrity impact is high because the attacker can act on behalf of the victim, including modifying account state; confidentiality is high because the attacker gains full access to the victim's data.

Impact Assessment

Successful exploitation yields complete compromise of the target account without credentials. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N maps to the following practical impact:

• Attack Vector (N): reachable over the network via the application's public authentication surface.
• Attack Complexity (H): exploitation only succeeds when the OAuth proxy is configured with the shared global secret and cookie-stored state; other configurations are unaffected.
• Privileges Required (N) / User Interaction (N): the attacker needs no account and no victim action.
• Confidentiality (H) / Integrity (H): the attacker reads and modifies the victim's account and any data reachable through it.
• Availability (N): no direct availability impact.

Blast radius: any application that both runs an affected Better Auth version and uses the OAuth Proxy plugin with the shared global secret + cookie-stored state. High-value targets include accounts with administrative roles, accounts linked to financial or healthcare data, and identities federated to other systems. Because implicit linking keys on the email address, any account whose verified email is known or guessable is a candidate. The scope is confined to the vulnerable component (S:U), but downstream trust in the compromised identity can extend the real-world impact beyond the application itself. No EPSS score is available, and the CVE is not in CISA KEV as of this writing.

Detection Guidance

Sigma Rule

title: Better Auth OAuth Proxy State Forgery - Implicit Account Linking
id: 8f1c2d5a-0b47-4c9e-9a3b-7d2e6b1f4a90
status: experimental
description: Detects authentication events where an OAuth proxy state-cookie flow results in implicit account linking, consistent with CVE-2026-110864 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110864
author: valtersit.com
date: 2026/01/01
logsource:
  category: authentication
  product: better-auth
detection:
  selection_callback:
    event.action:
      - 'oauth_callback'
      - 'oauth_proxy_callback'
      - 'sign_in_with_oauth'
  selection_link:
    event.outcome: 'success'
    account.linking_mode: 'implicit'
  selection_email_mismatch:
    oauth.state.source_ip|exists: true
    oauth.profile.email_verified: true
  condition: selection_callback and selection_link and selection_email_mismatch
fields:
  - user.email
  - oauth.profile.email
  - source.ip
  - user_agent.original
falsepositives:
  - Legitimate first-time OAuth logins with verified emails
level: high
tags:
  - attack.t1078
  - cve.2026-110864

YARA Rule

rule CVE_2026_110864_BetterAuth_OAuthProxy_StateForgery
{
    meta:
        description = "Detects web traffic and log artifacts referencing Better Auth OAuth Proxy state forgery patterns (CVE-2026-110864)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110864"
        cve = "CVE-2026-110864"

    strings:
        $p1 = "oauth_proxy" ascii nocase wide
        $p2 = "oauth-proxy" ascii nocase wide
        $p3 = "oauth_state" ascii nocase wide
        $p4 = "oauth_state_cookie" ascii nocase wide
        $p5 = "email_verified" ascii nocase wide
        $p6 = "global_secret" ascii nocase wide
        $p7 = "better-auth" ascii nocase wide

    condition:
        uint32(0) != 0x504b0304 and
        (
            (2 of ($p1, $p2, $p3, $p4, $p5) and $p7) or
            (2 of ($p1, $p2, $p3, $p4) and $p6)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110864 Better Auth OAuth Proxy State Forgery Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/auth"; nocase; http.uri; content:"oauth"; nocase; http.header; content:"Cookie"; nocase; http.header; content:"state"; nocase; pcre:"/state=[A-Za-z0-9%2B%2F%3D_-]{60,}/"; metadata:service http, cve CVE.2026-110864; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110864; classtype:attempted-user; sid:2026110864; rev:1;)

Elastic Detection

authentication where event.action in ("oauth_callback", "oauth_proxy_callback", "sign_in_with_oauth")
  and event.outcome == "success"
  and account.linking_mode == "implicit"
  and oauth.profile.email_verified == true

Splunk SPL Query

index=app sourcetype=better_auth OR sourcetype=web:proxy
| search (event_action=oauth_callback OR event_action=oauth_proxy_callback OR uri_path="/api/auth/*oauth*")
| eval suspicious_state=if(match(cookie_state, "^[A-Za-z0-9%2B%2F%3D_-]{60,}$"), 1, 0)
| eval implicit_link=if(account_linking_mode="implicit", 1, 0)
| where suspicious_state=1 AND implicit_link=1
| stats count values(user_email) as victim_candidates values(src_ip) as src_ips by _time, uri_path, user_agent
| sort - count

Wazuh OSSEC Rule

<group name="better_auth,authentication,cve-2026-110864">
  <rule id="110864" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">oauth_proxy_callback|oauth_callback</field>
    <field name="event.outcome">success</field>
    <field name="account.linking_mode">implicit</field>
    <description>CVE-2026-110864: Possible Better Auth OAuth Proxy implicit account linking via forged encrypted state</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description defines the fixed version as 1.7.7, but no vendor advisory, release note, or commit could be confirmed. Verify the fixed version against the upstream project before relying on it.

1. Immediate mitigations

   • Disable the OAuth Proxy plugin in any environment where it is not strictly required.
   • Where the plugin is required, do not configure the proxy to share the application's global secret; provision a separate, isolated secret for the proxy.
   • Move away from cookie-stored OAuth state to a server-side, session-bound state mechanism so that client-submitted state cannot be self-signed with shared key material.
   • Restrict network exposure of the authentication endpoints to trusted networks until a fix can be applied.
   • Enforce re-authentication or an additional challenge (for example, email-ownership verification) for any implicit account linking before it grants a session.

2. Patch / upgrade steps

   • Upgrade Better Auth to the fixed release (1.7.7 or later, per the description's range). Confirm against the upstream project's release notes, since no patch evidence was found in tracked sources.
   • After upgrading, audit configuration to confirm the global-secret sharing and cookie-stored-state pattern is no longer in use.
   • Force session invalidation and re-authentication for affected accounts as a precaution.

3. Long-term hardening

   • Cryptographically bind OAuth state to the initiating session (nonce + server-side storage) rather than trusting client-supplied encrypted blobs.
   • Adopt per-purpose secrets or key derivation so that one shared secret never validates multiple security-sensitive objects.
   • Treat email-based implicit account linking as an authentication decision requiring independent proof of mailbox control.
   • Add monitoring for implicit-link events on verified emails from new IPs/ASNs, and enforce alerting on the detection rules above.
   • Track CVE-2026-110864 for vendor advisory updates, patch commits, and any change in EPSS/KEV status.

References

• NVD — CVE-2026-110864: https://nvd.nist.gov/vuln/detail/CVE-2026-110864
• Better Auth project documentation and release notes (upstream advisory pending verification)
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• CISA Known Exploited Vulnerabilities Catalog (not currently listed; monitor for changes): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score calculated at time of writing): https://www.first.org/epss/