Better Auth OAuth State Reuse Magic Link

Better Auth, a TypeScript authentication framework increasingly utilized in the Node.js and Next.js ecosystem, contains a critical vulnerability ( GHSA-965c-763c-88jm ) stemming from a failure in verification record isolation. The flaw allows an attacker to initiate an OAuth sign-in flow for a target email address, generate a state value, and then redeem that same value at the Magic Link endpoint to authenticate as the victim. Because the system stores OAuth state records and Magic Link tokens in the same verification store using identical, un-namespaced values, the Magic Link handler fails to distinguish between the two. This bypass requires no access to the victim’s mailbox and grants the attacker a full session with all associated permissions. The vulnerability is rated with a CVSS score of 9.1.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.