Check package.json/pnpm-lock for better-auth >=1.4.0-beta.18 and <1.7.7 with both magicLink and a social/Generic OAuth plugin. Upgrade every node that shares verification storage to 1.7.7 together, then force users to request new Magic Links and restart incomplete OAuth/SAML flows (pre-upgrade state cannot complete safely). Temporary mitigations from the GHSA: account.storeStateStrategy: "cookie" (watch the OAuth Proxy secret caveat), or hashed Magic Link tokens with global verification.storeIdentifier left plain/unset, or disable one of the two flows. disableSignUp: true alone does not stop takeover of existing accounts.