An authentication bypass vulnerability in better-auth allows for account takeover, posing a severe risk to user account integrity.

This vulnerability is categorized as CWE-287, representing improper authentication. The flaw resides in the handling of magic link or email OTP processes, which does not require attacker authentication to exploit.

Successful exploitation of this vulnerability leads to complete account takeover, granting attackers unauthorized access to user accounts and their associated data. The high CVSS score of 8.3 reflects the ease of exploitation and the critical nature of the impact, which includes potential unauthorized data access and total loss of account control.

Immediate Action: Update the better-auth npm package to version 1.6.22 or 1.7.0-beta.10 to correct the authentication logic.

Proactive Monitoring: Monitor authentication logs for unusual patterns in login requests or multiple failed attempts involving magic links or OTPs.

Compensating Controls: Consider enforcing additional layers of authentication, such as multi-factor authentication (MFA), to mitigate the impact of account takeover attempts.

Public Exploit Available: No

Given the potential for full account takeover, this vulnerability is critical for all applications utilizing better-auth. Security teams must ensure that the application is updated to the specified patched versions to restore secure authentication functionality.