The vulnerability allows an unauthenticated attacker to hijack an existing user account by exploiting the OAuth sign‑in state as a Magic Link token. It stems from an improper authentication process (CWE‑287), where the same identifier is used for Magic Link verification records and OAuth state when certain configuration options are enabled. An attacker can trigger an OAuth flow for a known email address, intercept the returned state, and use it as a Magic Link to obtain a normal session for the target user or to create a new account marked as verified. The severity is high, with a CVSS score of 9.1, and the issue remains exploitable on unpatched installations.

This flaw exists in the Better Auth authentication library for TypeScript, versions 1.4.0‑beta.18 through 1.7.7, when deployments enable Magic Link with the storeToken option set to plain or hashed (and the global verification.storeIdentifier setting also set to hashed), use a built‑in social or generic OAuth provider, and configure account.storeStateStrategy to use a database. Deployments that use any of these combinations are vulnerable unless patched.

The attack vector is remote; an attacker only needs to initiate the OAuth flow for the victim’s email address. No mailbox control or provider callback completion is required. Because the vulnerability passes the OAuth state through the Magic Link verification process, it can be exploited from the internet against exposed endpoints. With a CVSS of 9.1, the potential impact is significant. The EPSS score is currently not available, and the vulnerability is not listed in CISA’s KEV catalog, but the high score and the ease of exploitation warrant immediate attention.