A flaw in Better Auth’s OAuth Proxy plugin lets an attacker forge encrypted user profiles and bypass normal authentication flows. By crafting an encrypted profile that carries a victim’s verified email address, the attacker can be treated as that victim during implicit account linking, thereby gaining full access to the victim’s account. The vulnerability is classed as CWE‑287 and permits unauthenticated remote users to log in as arbitrary accounts.

The issue affects Better Auth 1.5.0‑beta.12 up through 1.7.6 inclusive. Any installation using the OAuth Proxy plugin in those versions is vulnerable. Proper upgrades to 1.7.7 or later remove the flaw.

The CVSS score of 9.1 indicates critical severity and the attack can be carried out without authentication by submitting a crafted request to the OAuth Proxy endpoint. EPSS is not available, and the vulnerability is not yet in the CISA KEV catalog, but the high CVSS and the nature of the flaw mean that exploitation is likely if an attacker can manipulate the shared secret or obtain encrypted cookie state. The attack vector is a remote, unauthenticated request to the OAuth Proxy plugin that exploits improper handling of encrypted profile data.