Better Auth Magic Link OAuth State Confusion Flaw

Better Auth, a TypeScript authentication and authorization library, has a Magic Link and OAuth state confusion vulnerability in versions 1.4.0-beta.18 through 1.7.7.

Affected deployments require all of the following settings:

• Magic Link with storeToken set to plain, or with storeToken set to hashed and global verification.storeIdentifier also set to hashed
• A built-in social or Generic OAuth provider
• account.storeStateStrategy set to database

These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, letting an unauthenticated attacker start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.