Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical authentication bypass vulnerability within the Better Auth library, impacting how users sign in and are verified. The issue allows unauthenticated attackers to potentially impersonate other users by exploiting how OAuth and Magic Link tokens are handled, which could lead to unauthorized access or the creation of fraudulent accounts. The main concern at this time is confirming relevance and exposure.
- Attackers can bypass login security.
- Affects user authentication and account integrity.
- Confirm if this authentication method is in use.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by initiating an OAuth sign-in process using a victim's email address. The attacker then reuses a specific value, known as the "state" value, returned during this process. This reused state value is treated as a Magic Link token, allowing the attacker to bypass authentication and gain access to the victim's account or create a new account falsely associated with the victim's email.
- Unauthenticated network access.
- Reusing OAuth state as a Magic Link token.
- Unauthorized account access and creation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to bypass authentication mechanisms, potentially leading to unauthorized access to user accounts. This occurs by reusing specific values from the OAuth sign-in process as authentication tokens. The advisory indicates that when supported, attackers could sign in as other users or create falsely verified accounts by exploiting this flaw.
- User account access.
- Reusing OAuth state values as tokens.
- Unauthorized account access or creation.
Operational Fix
Recommended remediation, mitigation, and detection steps
The application owner and platform team are likely responsible for addressing this authentication bypass vulnerability. The initial step is to identify all instances of the affected authentication library, determine their reachability and criticality, and then coordinate remediation efforts based on risk.
- Application and platform teams own remediation.
- Verify affected technology reachability and criticality.
- Plan remediation based on confirmed ownership and risk.
