Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in the Better Auth library, which is used for authentication and authorization. If specific configurations are enabled, an attacker could potentially impersonate users or create accounts with false email verification. The main concern is to confirm if your specific implementation and configurations are affected by this issue.
- Attackers can bypass authentication with specific settings.
- Protects against unauthorized user access and account creation.
- Confirm configuration and exposure to this authentication flaw.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit this vulnerability by initiating an OAuth sign-in for a known email address. If the Better Auth library is configured with specific settings for Magic Link and OAuth, the attacker can then use the returned OAuth state value as a Magic Link token. This bypasses the need to control the email account or complete the provider's callback, allowing the attacker to gain a legitimate session as an existing user or create a seemingly verified account.
- Unauthenticated access to a vulnerable service.
- Triggers vulnerability via crafted OAuth state.
- Session takeover or unverified account creation.
Live Threat
Current exploitation, exposure, and threat context
When specific configuration settings are enabled, an unauthenticated attacker could impersonate users during OAuth sign-in. This could lead to unauthorized session establishment or falsely verified accounts.
- User sessions and account verification status.
- Exploiting specific library configurations.
- Gaining unauthorized user access.
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams responsible for application code, identity and access management, and potentially the platform hosting the application should investigate this vulnerability. The first practical step is to identify all instances of the affected library, confirm their exposure and criticality, and then engage the appropriate application owner to plan remediation.
- Application owners should take primary responsibility.
- Verify affected applications and their exposure.
- Plan remediation with vendor coordination.
