The vulnerability in better‑auth before version 1.6.2 allows an attacker to bypass OAuth state parameter validation when cookie‑backed state storage is used without PKCE. This bypass lets an adversary forge the state value and supply an attacker‑controlled authorization code, thereby creating authenticated sessions that the victim believes belong to themselves. The attacker can also persistently link their own external identity to the victim’s profile, enabling ongoing impersonation or account takeover. The weakness is classified as CWE‑287 (Improper Authentication).

The affected product is better‑auth (OAuth‑Provider) for Node.js. All releases prior to 1.6.2 are impacted, and the issue is specific to deployments that use cookie‑backed state without PKCE enabled.

The CVSS score of 6 indicates a medium severity for this flaw. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to craft or modify an OAuth request to the target server. By forging the state parameter during the authorization code flow, the attacker can redirect a legitimate authorization grant to themselves, resulting in unauthorized session creation or cross‑account linking. No special privileges or local access are needed beyond ability to influence the OAuth request.