Check Better Auth Magic Link and OAuth Proxy fixes

Better Auth's advisories describe two account-takeover paths. Both identify 1.7.7 as the patched version; the release notes confirm the Magic Link and OAuth Proxy fixes ^[1]^[2]^[3].

Read your lockfile and auth setup. The Magic Link advisory covers versions from 1.4.0-beta.18 up to, but excluding, 1.7.7. Its affected configuration combines social or Generic OAuth sign-in with database-backed OAuth state and one of these Magic Link storage setups ^[1]:

storeToken: "plain".
storeToken: "hashed" with global verification.storeIdentifier: "hashed".

The advisory says disableSignUp: true does not prevent takeover of existing accounts ^[1].

Check OAuth Proxy separately

The second advisory covers 1.5.0-beta.12 through versions before 1.7.7. It requires cookie-backed state, implicit account linking, and a missing dedicated proxy secret or one equal to the environment's global secret ^[2].

Switching between cookie and database state can expose the other issue. Read both advisories before choosing a workaround ^[1]^[2].

Upgrade the participating services together

Warning: the release notes say existing Magic Links and pending OAuth or SAML sign-ins must restart after the upgrade. Coordinate the change across servers sharing verification storage ^[3].

Install a supported patched release and update the associated Better Auth packages together. The 1.7.7 release notes state that no database migration is required for this fix ^[3]. Review the advisory's prefix changes if you use custom verification identifier overrides ^[1].

After deployment, request fresh Magic Links and exercise each configured login path. For OAuth Proxy, include every participating production and preview environment in that check ^[2]^[3].