ZDF
Sign inSign up

Vulnerabilities

Security incident · GHSA-r4xp-prcw-77qf

better-auth: OAuth Proxy lets an attacker sign in as another user

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · better-auth: OAuth Proxy lets

Last checked Oct 27, 2026, 11 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-r4xp-prcw-77qf. A missing EPSS score is not a low risk. Compare better-auth: OAuth Proxy lets with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (better-auth: OAuth Proxy lets).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
High7.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
npm better-auth

## Am I affected? You may be affected if you use from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated , or its equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie ( ). With a database or secondary storage, this is only the case if you chose it explicitly. - Implicit account linking is on (the default). You are not affected by this path if every participating environment uses a proxy distinct from its global Better Auth secret, if sign-in state is stored in the database, or if you use a version before 1.5.0-beta.12. ## Summary The OAuth Proxy plugin trusts any user profile it can decrypt. In the affected setup, Better Auth encrypts sign-in state, including data the caller chose, with the same secret and hands it to anyone who starts a social sign-in. An attacker can use this to get a fake profile for another user's email address that the proxy accepts as real. ## Impact An attacker without an account who knows a user's verified email address can sign in as that user, with that user's permissions. They can read private data, change the account, and link a provider account of their choice to it. They need no provider sign-in and no action from the victim. No availability impact is established, and a reported open redirect was not confirmed. ## Patches The fix is merged for the planned 1.7.7 release. That package is not available yet. Upgrade all nodes handling the same cookie-backed OAuth or SAML state flow and all OAuth Proxy participants together, including the production coordinator and preview or development deployments. Keep installed Better Auth packages released alongside on the same release version. Restart pending sign-in and account-linking flows; pre-upgrade state cookies and proxy payloads are rejected. Public options and API signatures are unchanged. ## Workarounds

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm better-auth>= 1.5.0-beta.12, < 1.7.7

How to fix GHSA-r4xp-prcw-77qf

  • Upgrade

    GHSA-r4xp-prcw-77qf lists a fix boundary at 1.7.7. Compare the installed build with that boundary before you change production.

  • Version check

    Affected < 1.7.7

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-r4xp-prcw-77qf. A missing EPSS score is not a low risk. Compare better-auth: OAuth Proxy lets with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with >= 1.5.0-beta.12, < 1.7.7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-287: Improper Authentication; CWE-345: Insufficient Verification of Data Authenticity. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ## Am I affected? You may be affected if you use from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated , or its equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie ( ). With a database or secondary storage,

  2. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ## Am I affected? You may be affected if you use from 1.5.0-beta.12 through versions before 1.7.7 with the OAuth Proxy plugin. You are affected only if **all** of these are also true: - On a participating environment, the OAuth Proxy plugin has no dedicated , or its equals that environment's global Better Auth secret. - Sign-in state is stored in a cookie ( ). With a database or secondary storage,

Sources

References

Freshness

Last verified in this catalog Oct 27, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 27, 2026