Better Auth OAuth State Reuse Magic Link

Better Auth, a TypeScript authentication framework increasingly utilized in the Node.js and Next.js ecosystem, contains a critical vulnerability ( GHSA-965c-763c-88jm ) stemming from a failure in verification record isolation. The flaw allows an attacker to initiate an OAuth sign-in flow for a target email address, generate a state value, and then redeem that same value at the Magic Link endpoint to authenticate as the victim. Because the system stores OAuth state records and Magic Link tokens in the same verification store using identical, un-namespaced values, the Magic Link handler fails to distinguish between the two.

Source: Forkast