Alavesa

**Name of the Vulnerable Software and Affected Versions** better-auth versions prior to 1.6.2 **Description** An issue exists where the software fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE (Proof Key for Code Exchange). In the `parseGenericState` function, the cookie branch decrypted the `oauth state` cookie and validated expiry but did not compare the incoming OAuth `state` query parameter to the nonce issued at sign-in. This allows attackers to forge the `state` parameter and provide an attacker-controlled authorization code to the `/api/auth/oauth2/callback/<providerId>` endpoint. This can lead to forced-login (CSRF on OAuth callback), where a victim's browser is placed into a session bound to the attacker's external identity, or persistent account linking, where an attacker's external account is bound to the victim's authenticated profile. **Recommendations** Upgrade to version 1.6.2 or later. Switch `storeStateStrategy` to `database`. Enable `pkce: true` on every affected `genericOAuth` provider.