---
title: Tip: if you ship Better Auth with Magic Link + OAuth, bump to 1.7.7 everywhere at once | ctxsec
url: https://ctxsec.com/items/tip-better-auth-1-7-7
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-better-auth-1-7-7.md)

how-to

2026-10-15

### Tip: if you ship Better Auth with Magic Link + OAuth, bump to 1.7.7 everywhere at once

Check `package.json`/`pnpm-lock` for better-auth >=1.4.0-beta.18 and <1.7.7 with both magicLink and a social/Generic OAuth plugin. Upgrade every node that shares verification storage to 1.7.7 together, then force users to request new Magic Links and restart incomplete OAuth/SAML flows (pre-upgrade state cannot complete safely). Temporary mitigations from the GHSA: `account.storeStateStrategy: "cookie"` (watch the OAuth Proxy secret caveat), or hashed Magic Link tokens with global `verification.storeIdentifier` left plain/unset, or disable one of the two flows. `disableSignUp: true` alone does not stop takeover of existing accounts.

Sources: [GHSA-965c-763c-88jm](https://github.com/better-auth/better-auth/security/advisories/GHSA-965c-763c-88jm)