CyberRota Analysis
AI-GeneratedThe Better Auth library for TypeScript, prior to version 1.6.11, is vulnerable due to improper handling of OAuth callback auto-linking, allowing attackers to link a victim's OAuth account to their own by exploiting the email verification mechanism. This vulnerability can lead to unauthorized account access and identity theft, particularly affecting applications that rely on this library for user authentication. Developers and organizations utilizing Better Auth should prioritize upgrading to version 1.6.11 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)