Better Auth GHSA-965c-763c-88jm (CVE-2026-110862, critical CVSS 9.1) covers versions from 1.4.0-beta.18 through before 1.7.7 when Magic Link and social/Generic OAuth are both enabled with default database-backed OAuth state. An attacker who knows a victim email can start an OAuth sign-in, take the returned state value, and submit it to Magic Link verification to get a normal session for that user—no mailbox access and no OAuth provider callback. If Magic Link sign-up is on, the attacker can also create an account falsely marked email-verified. Fixed in better-auth 1.7.7; upgrade adapters/plugins in lockstep and restart pending OAuth/Magic Link flows. Workarounds until patch: cookie-backed OAuth state, hashed Magic Link tokens with non-hashed global identifiers, or disable Magic Link or social/OAuth. Discovered by V12 (Rick de Jager); disclosure closed with the 1.7.7 release on Oct 1. Not on CISA KEV as of catalogVersion 2026.10.14.