CVE-2026-110862

Better Auth 1.4.0-beta.18 to 1.7.7 allows unauthenticated attackers to bypass authentication by reusing OAuth state values as Magic Link tokens, enabling session hijacking or false account creation.

This authentication bypass vulnerability lets attackers impersonate users or create fake verified accounts without needing valid credentials, directly violating NIST 800-171 requirements for access control and identity management. DIB organizations must patch this immediately to prevent unauthorized access to sensitive data and maintain compliance with the FCA's security mandates.

Shame score — An authentication bypass that allows unauthenticated attackers to hijack sessions or create false accounts is a severe, avoidable failure that undermines core identity and access management controls.