Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck
CVE-2026-67327better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
High 8.3
In plain English
A high-severity improper authentication in better-auth from better-auth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | better-auth | 1.6.22 | GHSA-qq9h-g4jm-xgf3 |
| npm | better-auth | 1.7.0-beta.10 | GHSA-qq9h-g4jm-xgf3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| better-auth | better-auth | 1.1.3 – before 1.6.22 |
| better-auth | better-auth | 1.7.0-beta.0 – before 1.7.0-beta.10 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
References
- GitHub Security Advisory (GHSA-qq9h-g4jm-xgf3) vendor-advisory
- VulnCheck Advisory: better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP third-party-advisory