Better Auth versions 1.4.0-beta.18 through 1.7.6 allow an attacker to bypass authentication by reusing OAuth state values as magic link tokens. The flaw lets an unauthenticated user submit a state value returned from an OAuth sign‑in attempt that uses a victim’s email. If the state token is accepted during magic link verification, the attacker gains a valid session or creates a false email‑verified account for the victim. This vulnerability results in full impersonation of the victim without any credential compromise. The weakness is a classic authentication bypass (CWE‑287).

All deployments of Better Auth version 1.4.0-beta.18 up to and including 1.7.6 are affected. The product is referred to as Better Auth:better-auth by the CNA. Any instance that relies on the magic link feature and supports OAuth-based sign‑in during that version range is susceptible.

The CVSS score of 9.3 classifies this as critical. The EPSS score is not available, but the flaw admits remote exploitation through public OAuth interfaces, making it highly exploitable in a networked environment. Because the issue is not listed in CISA’s KEV catalog, there is no known widespread exploitation at the time of analysis. The likely attack vector is through an externally accessible OAuth endpoint combined with the magic link verification flow, allowing attackers to fabricate state values and hijack sessions.