# Check Better Auth Magic Link and OAuth Proxy fixes

> Check the affected login configurations and coordinate the upgrade across participating servers.

Source: https://fullbytedeveloper.com/blog/better-auth-magic-link-security-update
Keyword: AUTHFIX
Published: 2026-11-05

Better Auth's advisories describe two account-takeover paths. Both identify `1.7.7` as the patched version; the release notes confirm the Magic Link and OAuth Proxy fixes [1][2][3].

## Check the installed release and login configuration

Read your lockfile and auth setup. The Magic Link advisory covers versions from `1.4.0-beta.18` up to, but excluding, `1.7.7`. Its affected configuration combines social or Generic OAuth sign-in with database-backed OAuth state and one of these Magic Link storage setups [1]:

- `storeToken: "plain"`.
- `storeToken: "hashed"` with global `verification.storeIdentifier: "hashed"`.

The advisory says `disableSignUp: true` does not prevent takeover of existing accounts [1].

## Check OAuth Proxy separately

The second advisory covers `1.5.0-beta.12` through versions before `1.7.7`. It requires cookie-backed state, implicit account linking, and a missing dedicated proxy secret or one equal to the environment's global secret [2].

Switching between cookie and database state can expose the other issue. Read both advisories before choosing a workaround [1][2].

## Upgrade the participating services together

**Warning:** the release notes say existing Magic Links and pending OAuth or SAML sign-ins must restart after the upgrade. Coordinate the change across servers sharing verification storage [3].

Install a supported patched release and update the associated Better Auth packages together. The `1.7.7` release notes state that no database migration is required for this fix [3]. Review the advisory's prefix changes if you use custom verification identifier overrides [1].

After deployment, request fresh Magic Links and exercise each configured login path. For OAuth Proxy, include every participating production and preview environment in that check [2][3].

## Sources

1. [Better Auth Magic Link advisory](https://github.com/advisories/GHSA-965c-763c-88jm)
2. [Better Auth OAuth Proxy advisory](https://github.com/advisories/GHSA-r4xp-prcw-77qf)
3. [Better Auth v1.7.7 release](https://github.com/better-auth/better-auth/releases/tag/v1.7.7)

## Original posts

- [Instagram reel](https://www.instagram.com/reel/DfENMMFHCbQ/)
- [TikTok video](https://www.tiktok.com/@fullbytedeveloper/video/7701950128625569044)
- [YouTube Short](https://www.youtube.com/shorts/-wM4XbxKj_o)
- [Facebook reel](https://www.facebook.com/reel/29986258087641379)
- [Threads post](https://www.threads.com/@fullbytedeveloper/post/DfENMitkQBl)