The vulnerability in better‑auth allows an attacker to hijack an account by registering the victim’s e‑mail and a chosen password. When the legitimate user later signs in using magic‑link or email‑OTP, the account is marked verified but the attacker’s password remains valid, giving the attacker persistent access. This bypasses authentication and is described as CWE‑287.

The affected product is better‑auth OAuth Provider for Node.js. All released versions from 1.1.3 up to, but not including, 1.6.22 and the pre‑release <1.7.0‑beta.10 are vulnerable. These versions expose a pre‑account creation path when open e‑mail/password registration is enabled.

The CVSS score is 8.7, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs the victim’s e‑mail address and the ability to submit a registration request; no privileged access is required. Because the attack path is part of the normal sign‑in flow, it can be exploited remotely with minimal effort, making it a high‑risk exposure until mitigated.