https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 09:19:04 +0000 https://cve.radiocsirt.org/vuln/cve-2026-53516 <p><strong>Affected:</strong> better-auth</p> <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth&#39;s OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row&#39;s emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim&#39;s OAuth identity to the attacker&#39;s account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.</p> <p><strong>Affected:</strong> better-auth</p> <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth&#39;s OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row&#39;s emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to bind the victim&#39;s OAuth identity to the attacker&#39;s account. The same primitive affects one-tap, and emailAndPassword.requireEmailVerification: true does not mitigate the link-time verification change. This issue is fixed in version 1.6.11.</p> https://cve.radiocsirt.org/vuln/cve-2026-53516