better-auth CVE-2026-67327

All three of the following conditions must hold simultaneously for exploitation to be possible: (1) the application runs better-auth >= 1.1.3 and < 1.6.22 on the stable line, or >= 1.7.0-beta.0 and < 1.7.0-beta.10 on the pre-release line; (2) either the magic-link plugin or the email-OTP plugin is enabled and exposed to users; (3) open email/password registration is enabled, allowing an attacker to register an arbitrary email address without prior ownership verification. Exploitation is additionally bounded by a timing constraint: the attacker must complete registration with the victim's email before the victim's first successful passwordless authentication - once the legitimate owner has signed in via the passwordless flow even once under the patched code path, the pre-hijack opportunity is permanently closed. The UI:P in the CVSS 4.0 vector reflects that the victim's action (their first passwordless login) is a required step in completing the attack. Applications that enforce email verification before accepting any password, or that disable open registration (invite-only flows), significantly reduce exposure but do not fully eliminate it per the vendor advisory.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L) reflects a serious but user-interaction-dependent vulnerability: the attacker can position the trap remotely with no privileges, but the victim must perform a passwordless login to trigger account verification and complete the attack. VC:H/VI:H indicate full confidentiality and integrity compromise of the victim's account. No EPSS data was provided, so exploitation probability cannot be quantified numerically. This CVE does not appear in the CISA KEV catalog and no public POC has been identified at time of analysis. Despite the absence of known active exploitation, real-world risk should be considered elevated for any application meeting all three prerequisite conditions simultaneously (open registration + magic-link or OTP plugin + no prior email verification enforcement). The attack window is bounded by timing - it closes once the legitimate owner completes their first passwordless login - but many applications have long-dormant accounts or onboard users slowly, extending this window significantly. The attack requires no special technical skill beyond knowing the target's email address and being able to register on the application.

An attacker learns the email address of a target who has not yet registered on the application (e.g., a newly invited user). Before the target's first login, the attacker visits the registration page and creates an account using the target's email and a password of their choosing; the account remains in an unverified state. When the target receives their invitation and signs in via a magic-link or email-OTP, the better-auth library marks the account verified and issues the target a valid session - but the attacker's password hash is still in the database and all pre-existing sessions remain active. The attacker then logs in normally with the planted credentials and has full, persistent access to the victim's account.