Listen to this Post
The vulnerability resides in parseGenericState function’s cookie branch. When storeStateStrategy is set to “cookie” (non-default), better-auth stores OAuth state in an encrypted cookie but fails to compare the incoming state query parameter against the nonce inside that cookie. An attacker can forge any state value and any authorization code, then force a victim’s browser to visit the OAuth callback endpoint. As long as the victim still holds a valid oauth_state cookie, the callback accepts the forged state and code. With pkce: false on a genericOAuth provider, there is no code_verifier check, so the attacker can supply their own code from a provider they control. The callback then exchanges that code for tokens and creates a session in the victim’s browser bound to the attacker’s external identity. Account-linking flows similarly bind the attacker’s external account to the victim’s authenticated user row. The database branch (default) is immune because the verification row is keyed by state, enforcing equality on lookup. The fix adds an equality check: generateGenericState writes oauthState into the encrypted payload, and parseGenericState rejects when parsedData.oauthState !== incoming state. The patch was merged via PR 8949 (commit 9deb7936a) on 2026-04-09.
Platform: better-auth Node.js
Version: below 1.6.2
Vulnerability: OAuth state bypass
Severity: Critical
date: 2026-05-15
Prediction: Fixed in 1.6.2
What Undercode Say:
Check vulnerable versions npm list better-auth | grep -E "1.[0-5]." Simulate missing nonce check (conceptual) curl -i "https://app.example/api/auth/oauth2/callback/generic?state=attacker_forged&code=attacker_code" \ -H "Cookie: oauth_state=encrypted_valid_cookie" Verify upgrade npm install [email protected] Audit cookie strategy usage grep -r "storeStateStrategy.cookie" src/
Exploit:
- Attacker hosts malicious OAuth provider or reuses code from their own account.
- Victim has existing oauth_state cookie (e.g., from prior login attempt).
- Attacker sends victim a crafted link to
/api/auth/oauth2/callback/provider?state=evil&code=attacker_code. - Victim’s browser follows link, callback accepts forged state, exchanges attacker’s code.
- Victim’s session now belongs to attacker’s external identity; attacker can view victim’s activity.
Protection from this CVE
- Upgrade to [email protected] or later (current 1.6.10).
- If unable to upgrade, set `storeStateStrategy` back to “database” (default).
- Enable `pkce: true` on every `genericOAuth` provider.
- For custom
getToken/tokenUrl, enforce code_verifier round-trip.
Impact
- Forced login: attacker hijacks victim’s session to observe internal actions.
- Persistent account linking: attacker’s external account permanently bound to victim’s user row.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
