Key points
- CVE-2026-110864 affects Better Auth versions 1.5.0-beta.12 through 1.7.6.
- The flaw allows unauthenticated attackers to bypass authentication checks.
- Exploitation involves forging encrypted profiles to link to victim accounts.
Better Auth versions prior to 1.7.7 contain a critical authentication bypass vulnerability that enables attackers to hijack user accounts. The flaw resides in the OAuth Proxy plugin and allows unauthenticated actors to sign in as other users. According to the National Vulnerability Database, the issue stems from how encrypted profiles are handled during the authentication process.
Attackers exploit this by forging encrypted profiles that include a victim's verified email address. When the proxy shares a global secret and uses cookie-stored state, the system accepts these fake profiles. This leads to implicit linking, granting the attacker full access to the targeted account. The National Vulnerability Database rates CVE-2026-110864 as critical with a CVSS score of 9.1.
What we know
The vulnerability is classified under CWE-287, which covers improper authentication mechanisms. It specifically impacts the Better Auth library, a tool used by developers for managing user authentication. The issue exists in all versions from 1.5.0-beta.12 up to, but not including, 1.7.7. The attack vector requires no prior credentials, making it accessible to any external threat actor who can reach the service.
This incident follows a pattern of authentication flaws in popular libraries. As Malware Chronicle reported on October 12, 2026, PraisonAI also faced a critical auth bypass in CVE-2026-57118. Developers must remain vigilant for similar issues in their dependency chains, where unpatched components can expose entire applications to takeover risks.
Defender's checklist
- Verify your current Better Auth version is at least 1.7.7.
- Review OAuth Proxy configurations for shared global secrets.
- Audit logs for unexpected account linking or profile changes.
- Monitor for anomalous login patterns from unauthenticated sources.
What analysts watch for
Teams usually examine authentication logs for signs of profile forgery or unexpected account linking events. Analysts check whether the application relies on cookie-stored state for critical security decisions, as this can be manipulated. They also review network traffic for unusual OAuth proxy requests that do not match standard user behavior. Investigating how encrypted profiles are generated and validated helps identify if the system trusts external inputs too readily, which is a common trait in this category of breach.
Background: Account takeover
Account takeover occurs when an attacker gains unauthorized access to a user’s digital identity. This happens through stolen credentials, session hijacking, or authentication flaws. The attacker controls the account, accessing data and performing actions as the legitimate user, often bypassing traditional perimeter security measures entirely.
Read the full guide: Account Takeover: Definition, Vectors, and Defense Strategies
What to do and how to stay safe: Better Auth
- Update your Better Auth library to version 1.7.7 or later immediately.
- Rotate any global secrets used by the OAuth Proxy plugin.
- Review recent authentication logs for suspicious account takeover attempts.
- Implement additional monitoring for anomalous OAuth profile creation events.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Better Auth are affected by CVE-2026-110864?
Versions from 1.5.0-beta.12 up to, but not including, 1.7.7 are vulnerable.
How do attackers exploit this vulnerability?
They forge encrypted profiles with a victim's verified email to bypass authentication and take over accounts.
Is there a fix available for this critical flaw?
Yes, updating to Better Auth version 1.7.7 or higher resolves the issue.
