EUVD-2026-51841
GHSA-9wm3-rh5c-fc37
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no attacker privileges; victim's passwordless login triggers the flaw (UI:R); full account takeover yields C:H/I:H; A:L for minor session disruption to the victim.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on better-auth (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.1.3.
DescriptionCVE.org
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
AnalysisAI
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any victim account on applications that combine open email/password registration with the magic-link or email-OTP passwordless plugins. The attacker plants a password on the victim's email address before the legitimate owner ever signs in; when the owner later authenticates via the passwordless flow, the library verifies the account without clearing the pre-existing password or revoking pre-existing sessions, leaving the attacker's credentials valid. No public exploit identified at time of analysis, but the attack is mechanically trivial and requires only the ability to register an account - no special tooling, credentials, or network position needed.
Technical ContextAI
better-auth is a Node.js authentication framework distributed via npm (CPE: cpe:2.3:a:better-auth:better-auth). It provides modular plugins for various authentication flows, including magic-link and email-OTP passwordless sign-in alongside traditional email/password registration. The root cause is CWE-287 (Improper Authentication): when either passwordless plugin resolves an incoming verification event, it locates the existing account record for the target email and transitions its state to verified, issuing a new session. Before the fix, this state transition did not treat proof of email ownership as authoritative over previously stored credentials - it neither removed the password hash set during unverified pre-registration nor revoked sessions that had been created prior to any email verification. The library effectively conflated 'account exists for this email' with 'the current actor owns this account,' a pre-account-hijacking class flaw analogous to the OAuth pre-hijacking pattern documented in GHSA-g38m-r43w-p2q7. The fix (PR #10239, commit c06a56d) corrects this by treating the passwordless verification event as the canonical proof of ownership: it removes any previously set password and revokes all pre-existing sessions before issuing the new verified session.
RemediationAI
Upgrade to better-auth 1.6.22 or later on the stable npm release line, or to 1.7.0-beta.10 or later on the pre-release line; both versions are confirmed fixed by the vendor advisory GHSA-qq9h-g4jm-xgf3, with the fix implemented in PR #10239 (commit c06a56d83a40bbaeac12d3a8b8b67e59f92a9110). If an immediate upgrade is not possible, two partial mitigations can reduce but not eliminate risk: first, configure the application to require email verification before accepting a password on any account, which adds a barrier that slows the attack setup; second, implement aggressive purging of unverified accounts to shrink the window during which a pre-planted account can sit waiting. Both workarounds reduce the attack surface but do not close the vulnerability, as the vendor advisory explicitly states. Neither mitigation addresses the core flaw - that verification does not revoke prior credentials - so upgrading remains the only complete remediation.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days afte
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today