Summary
A pre-account hijacking flaw in better-auth allows attackers to take over user accounts when open email/password registration is combined with magic-link or email-OTP sign-in.
By pre-registering an unverified account with a victim's email and a chosen password, an attacker can retain valid password-based access even after the legitimate user verifies the account through passwordless flows.
Affected context
This vulnerability arises in applications using better-auth where:
- Open email/password registration is enabled
- Magic-link or email-OTP passwordless sign-in is available
- Verification of accounts does not clear or reconcile pre-existing credentials and sessions
It is most relevant in environments where user email addresses can be guessed or are predictable and where pre-verification accounts are not tightly controlled.
Exploit preconditions
- Attack surface: Public-facing authentication endpoints (registration, magic-link, email-OTP sign-in)
- Required access: Ability to create accounts using arbitrary email addresses; knowledge of or ability to guess the victim's email
- Trigger point: The legitimate user later signs in using a magic-link or email-OTP flow, which verifies the pre-created account without revoking its password or sessions
- Why exploitation is possible: The system treats verification as an additive state change, leaving existing password credentials and sessions intact, so an attacker's pre-set password continues to grant access even after the real user starts using the account.
Why this happens
The core issue is an authentication and account lifecycle flaw where account verification and credential management are not tightly coupled.
When an unverified account is created with an email/password and later verified through a passwordless flow, the implementation fails to reconcile or invalidate existing credentials and sessions tied to that identity.
This aligns with CWE-287: Improper Authentication, since the system improperly maintains trust in an attacker-established password and session after a new, legitimate authentication channel (magic-link or OTP) is used, allowing multiple principals to share the same logical account.
Potential impact
- Attackers may maintain persistent access to victim accounts even after legitimate verification
- Unauthorized viewing or modification of user data associated with the compromised account
- Abuse of the victim's account for fraud, spam, or further compromise of connected services
- Erosion of trust in passwordless authentication and account verification mechanisms
General mitigation guidance
Effective mitigation focuses on tightening the relationship between identity verification, credentials, and sessions.
Common defensive patterns include:
- Ensuring that verification events (e.g., magic-link or email-OTP sign-in) trigger reconciliation of all existing credentials and sessions for that identifier
- Invalidating or requiring re-confirmation of any password or secondary authentication factor created before verification
- Treating unverified accounts as provisional and limiting their capabilities, including login and session persistence
- Using clear ownership confirmation flows when a new verification method is used on an existing, partially registered account
- Designing account lifecycle states so that only a single, verified principal can control credentials for a given email identity
How teams detect issues like this
Detection can focus on both design-time and runtime signals:
- Static and design reviews that examine account lifecycle state diagrams, especially transitions from unverified to verified states and how credentials are handled
- Code review checks for flows where passwordless verification updates account status without explicitly revoking or revalidating pre-existing passwords and sessions
- Authentication logging that correlates account creation, verification events, and subsequent logins, looking for patterns where different IPs, user agents, or geographies access the same account shortly after verification
- Policy-based tests or automated tools that simulate pre-account hijacking scenarios (pre-registered email plus later passwordless verification) to ensure that credentials and sessions are reconciled correctly
