Better Auth’s OAuth callback auto‑link mechanism in handleOAuthUserInfo implicitly links accounts when the OAuth provider reports email_verified: true, but it does not confirm that the local user record’s emailVerified flag is also true. As a result, an attacker who first pre‑registers a victim’s email address through the /sign‑up/email endpoint can later bind that victim’s OAuth identity to the attacker’s own account. The same weakness also applies to one‑tap flows, and the emailAndPassword.requireEmailVerification setting does not protect against this link‑time verification flaw. The flaw is corrected in version 1.6.11. Because it permits unauthorized account binding, the vulnerability allows an attacker to take over a target account, a serious issue categorized as CWE‑287 and CWE‑345.

The affected product is Better Auth, a TypeScript authentication and authorization library. The flaw exists in all versions released before v1.6.11, affecting the OAuth callback logic, one‑tap flows, and email‑and‑password flows that rely on email verification. Users deploying pre‑1.6.11 versions of Better Auth are subject to the risk.

The CVSS score of 8.3 indicates high severity, while the EPSS score < 1% shows a very low likelihood of present exploitation in the wild. There is no listing in the CISA KEV catalog, so it is not a currently known exploited vulnerability. The likely attack vector involves an attacker first registering a pre‑verified email that matches the victim, then directing the victim’s OAuth authentication through the vulnerable application, which will auto‑link the victim’s OAuth credential to the attacker’s account. The attack requires no privileged state or elevated permissions beyond normal application usage.