CVE-2026-53516
CVE-2026-53516 · Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.
CVSS 8.3 · Hoch · EPSS 0,3% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: node
Betroffene Produkte und Versionen
better-auth
- Softwareversionen
- < 1.6.11: Betroffen
Keine Korrektur veröffentlicht
better-auth npm
- Betroffene Versionsbereiche
- SEMVER: < 1.6.11
Auf 1.6.11 aktualisieren
Originalquellen
- https://github.com/better-auth/better-auth/security/advisories/GHSA-g38m-r43w-p2q7
- https://github.com/better-auth/better-auth/pull/9578
- https://github.com/better-auth/better-auth/commit/da7e50beee849c59a2ed1ec6b3a38cc6ab9fb563
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11
- https://nvd.nist.gov/vuln/detail/CVE-2026-53516