CyberRota Analysis
AI-GeneratedVersions of better-auth prior to 1.6.2 are vulnerable due to inadequate validation of the OAuth state parameter, allowing attackers to forge this parameter and manipulate authentication processes. This could lead to unauthorized access, enabling attackers to create sessions tied to their identity or link their accounts to victims' profiles. Organizations using affected versions should prioritize patching to mitigate potential account takeover risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.