CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Attackers can take over accounts by pre-registering a victim's email and exploiting OAuth auto-linking that trusts provider email verification without checking local status.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53516?
CVE-2026-53516 is a high-severity authentication bypass vulnerability in better-auth, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim's OAuth identity to the attacker's account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.
Which versions are affected by CVE-2026-53516?
2 open source packages ship an affected version, including better-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | All versions | 1.6.11 |
better-auth npm | All versions | 1.6.11 |
Products include Better-Auth Better Auth.
How do I fix CVE-2026-53516?
Upgrade better-auth to 1.6.11 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-53516 being exploited?
There is no known exploitation of CVE-2026-53516 in the wild and no public exploit code.
Other vulnerabilities in better-auth
- CVE-2026-53512 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
- CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
- CVE-2026-53514 Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
- CVE-2026-45337 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
- CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Sources
Also known as GHSA-g38m-r43w-p2q7.