Detections
Analytics

SCA: security update for better-auth (GHSA-965c-763c-88jm)

critical Tenable Self-Hosted Container Security Plugin ID 477639

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7,
 deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the
 global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth
 provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a
 Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to
 the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email
 address and redeem the returned state through Magic Link without controlling the mailbox or completing the
 provider callback. The attacker can obtain a normal session for an existing user, or create an account
 incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.
 (CVE-2026-114607)

Solution

Update the better-auth library and its related packages to version 1.7.7 or later.

See Also

https://github.com/advisories/GHSA-965c-763c-88jm

Plugin Details

Severity: Critical

ID: 477639

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.53

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-114607

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-114607

cwe: CWE-287