better-auth: OAuth state can be used as a Magic Link to sign in as another user.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain" , or with storeToken: "hashed" and global verification.storeIdentifier: "hashed" (including a hashed default). - At least one built-in social provider or Generic OAuth provider is enabled. - OAuth state uses account.storeStateStrategy: "database" , the default when a database or secondary storage is configured. Cookie-backed st
Timeline
30 Sep- Published by GitHub advisory30 Sep
- Seen by Patchwire23 Oct
- Fix released30 Sep
Versions of better-auth
Packages
Stacks
Related alerts(3)
Same packagesSource summary
Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 (including the 1.7.0 prereleases from beta.6 through rc.6) or stable 1.6.x releases of @better-auth/kysely-adapter from 1.6.17 onward, and keep rate-limit records in a PostgreSQL database. This also applies when you use the affected Drizzle adapter bundled with better-auth . All of these must be true: - Rate limiting is enabled. - Rate-limit records are stored in the database. - The database is PostgreSQL, used through one of the adapter versions above. You are not affected if you
- Affected
- @better-auth/drizzle-adapter >=1.6.17 <1.7.7 · @better-auth/kysely-adapter >=1.6.17 <1.7.0 · better-auth >=1.6.17 <1.7.7
- Fixed in
- 1.7.7 · 1.7.0
- ID
- GHSA-44jh-23m7-hpcf
Source summary
Am I affected? You may be affected if you use better-auth from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if all of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated secret , or its secret equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie ( account.storeStateStrategy: "cookie" ). With a database or secondary storage, this is only the case if you chose it explicitly. - Implicit account linking is on (the default). You are not affected by this path if every pa
- Affected
- better-auth >=1.5.0-beta.12 <1.7.7
- Fixed in
- 1.7.7
- ID
- GHSA-r4xp-prcw-77qf
Source summary
Am I affected? You may be affected if you use better-auth from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3 , and you enable the deviceAuthorization() plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device request: validateClient is not configured, or the attacker can use a valid public client. - Before allowing approval, your approval page does not show, from server-checked data, which client is asking and the exact permissions it requests. - Users may approve a code or complete verification link they did not st
- Affected
- better-auth >=1.3.8-beta.3 <1.7.0-rc.3
- Fixed in
- 1.7.0-rc.3
- ID
- GHSA-q84f-53jg-9ppm