CVE-2026-110864

{
  "etk_id": "ETK-2026-1613",
  "cve_id": "CVE-2026-110864",
  "display_id": "CVE-2026-110864",
  "ghsa_id": "GHSA-r4xp-prcw-77qf",
  "euvd_id": "EUVD-2026-101747",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth Proxy authentication bypass in Better Auth",
  "summary": "Better Auth versions from 1.5.0-beta.12 before 1.7.7 are affected in the OAuth Proxy plugin. An unauthenticated attacker may be able to impersonate another user when the proxy uses the global secret and OAuth state is stored in cookies.",
  "mitigation": "Upgrade better-auth to version 1.7.7 or later. Until upgraded, reduce exposure by avoiding the affected combination of a shared global secret and cookie-stored OAuth state.",
  "vendor": "better-auth",
  "product": "better-auth",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.5.0-beta.12, < 1.7.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.7.7"
      ],
      "package_name": "better-auth",
      "purl": "pkg:npm/better-auth"
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0029,
  "epss_percentile": 0.2003,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 25.493893516666667,
  "t0_at": "2026-10-14T22:52:51.393000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-14T23:45:16.750659+00:00",
      "days": 0.03640460253472222,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T22:52:51.393000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-30T21:32:26+00:00",
      "days": -14.05584945601852,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T22:52:51.393000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110864"
    }
  }
}