Better Auth EUVD-2026-101747

Exploitation requires the application to use Better Auth's OAuth Proxy plugin configured with a shared global secret AND cookie-stored OAuth state - this is the exact condition under which an attacker can obtain/forge an encrypted state blob for a fake profile. The forged profile must carry a victim's verified email so that the implicit account-linking path links the attacker's sign-in to the victim's account. Limiting factors: this is not the default for all deployments (the plugin is optional and the shared-secret/cookie-state mode must be in use), and the vendor rated attack complexity high with a present attack requirement (AC:H/AT:P), reflecting the non-trivial, configuration-dependent nature; no victim interaction or attacker authentication is required (PR:N/UI:N). Not vulnerable: installs on 1.7.7 or later, or those not using the OAuth Proxy plugin in the affected configuration.

This is a genuine high-priority issue, not merely a high-CVSS-but-low-real-risk flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H) describes a remotely reachable, unauthenticated (PR:N) authentication bypass yielding full account takeover with high confidentiality and integrity impact - among the most serious outcomes for an auth framework. The tempering signals are AC:H and AT:P: exploitation is not trivial or sprayable because it depends on a specific deployment configuration (shared global secret plus cookie-stored OAuth state) rather than affecting every default install. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or automated exploitation at this time; the realistic risk is targeted account takeover against the subset of Better Auth deployments using the OAuth Proxy plugin in the vulnerable configuration. In short, high technical severity confirmed by the vendor/NVD advisory, but exploitation is conditional and exploitation-in-the-wild is unconfirmed - treat as urgent-to-patch for affected configurations while noting the attack-requirement caveat.

An attacker targeting an application that deploys Better Auth's OAuth Proxy plugin with a shared global secret and cookie-stored state crafts a forged encrypted state blob describing a fake OAuth profile carrying the victim's verified email address. Because the proxy trusts the shared-secret-encrypted profile, the application performs implicit account linking and signs the attacker in as the victim, resulting in full account takeover. No public exploit code was identified at time of analysis, so exploitation would require the attacker to reproduce the forging technique from the advisory.