{"id":"ghsa-ghsa-965c-763c-88jm","seq":1708803,"kind":"advisory","title":"better-auth: OAuth state can be used as a Magic Link to sign in as another user","url":"https://github.com/advisories/GHSA-965c-763c-88jm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-965c-763c-88jm","summary":"影響: npm:better-auth >= 1.4.0-beta.18, < 1.7.7 → 1.7.7\nAm I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: \"plain\", or with storeToken: \"hashed\" and global verification.storeIdentifier: \"hashed\" (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses account.storeStateStr…","severity":"critical","techs":["nodejs"],"cves":["CVE-2026-114607"],"tags":["GHSA-965c-763c-88jm","better-auth"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:32:05.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}