HighVulnerabilityGHSA-r4xp-prcw-77qfupdated 27 Oct 2026, 15:32 UTC

Better Auth OAuth Proxy can let attackers sign in as other users

Under certain settings, someone without an account could forge a login as another user if they know that user's verified email address. The attacker could then read private data or change the account.

Partial fixOfficial source

Severity	HighCVSS 7.4 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Partly1.7.7 (merged, but not yet released at time of advisory; the package is not available yet) · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Attacker without accountKnows victim's verified email address
2Starts social sign-inRequests encrypted sign-in state
3Forges profileEncrypts fake profile with shared secret
4Proxy accepts profileTrusts any profile it can decrypt
5Account takeoverAttacker gets victim's access and data
ResultAttacker signs in as the victim

What happened

The OAuth Proxy plugin in better-auth trusts any user profile it can decrypt. When sign-in state is stored in a cookie and the proxy shares the global Better Auth secret, an attacker can craft a fake profile for a victim's email that the proxy accepts.

Why it is dangerous: An attacker needs no password, no provider sign-in and no action from the victim, so any account whose email is known can be taken over, its data read and changed, and an attacker-chosen provider account linked to it.

Are you affected?

You are affected if you run better-auth from 1.5.0-beta.12 before 1.7.7 with the OAuth Proxy plugin, its secret is missing or equal to the global Better Auth secret, sign-in state is stored in a cookie, and implicit account linking is on (the default).

Package / product	Affected versions	Fixed in
better-auth · npm	>= 1.5.0-beta.12, < 1.7.7	1.7.7

What to do

Set one strong, unique OAuth Proxy secret on every environment in the proxy flow, different from the global Better Auth secret, as an interim workaround
Or set account.storeStateStrategy to "database" (default when a database or secondary storage is configured), and review the Magic Link note in the advisory if that flow is enabled
Or set account.accountLinking.disableImplicitLinking to true to stop the account-linking path, or remove the OAuth Proxy plugin if you do not need it
Once better-auth 1.7.7 is released, upgrade all OAuth Proxy participants and related packages together, then restart pending sign-in flows

Timeline

27 Oct 2026, 15:32 UTC
Publicly disclosed
27 Oct 2026, 15:32 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 15:32 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

better-auth: OAuth Proxy lets an attacker sign in as another userGitHub Advisory · 27 Oct 2026, 15:32 UTC

Technical details

ID: GHSA-r4xp-prcw-77qf
CVSS: 7.4 / 10
Disclosed: 27 Oct 2026, 15:32 UTC
On Zero Radar: 27 Oct 2026, 15:32 UTC (0 min after disclosure)
Last change: 27 Oct 2026, 15:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works