Description
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| better-auth | better-auth | < 1.6.2 | 1.6.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | better-auth | < 1.6.2 | 1.6.2 | GHSA-wxw3-q3m9-c3jr |
References
- GitHub Security Advisory (GHSA-wxw3-q3m9-c3jr) vendor-advisory
- VulnCheck Advisory: better-auth before 1.6.2 OAuth State Validation Bypass third-party-advisory