better-auth: OAuth state can be used as a Magic Link to sign in as another user
What to do
- Upgrade to a fixed version: better-auth 1.7.7.
- Redeploy and restart long-running processes so they load the fixed code.
Affected packages
better-auth
- >= 1.4.0-beta.18, < 1.7.7
- 1.7.7
Check your project: npm ls better-auth --all
Is better-auth@1.7.7 safe to install? See the upgrade verdict →
What changed
Published in the GitHub Advisory Database as critical.