Better Auth Authentication Bypass Lets Attackers Sign In as Other Users

Better Auth versions from 1.4.0-beta.18 before 1.7.7 are affected by an authentication bypass vulnerability.

Unauthenticated attackers can sign in as other users by reusing OAuth state values as Magic Link tokens.

• Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification.
• This can result in gaining sessions or creating falsely email-verified accounts.