[GH-ISSUE #5055] Social and SSO auth callback fails after version 1.3.13 #10154

New Issue

2026-04-13T06:06:28-05:00

GiteaMirror commented

2026-04-13 06:06:28 -05:00

Originally created by @rohovskoi on GitHub (Oct 2, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5055

Is this suited for github?

Yes, this is suited for github

To Reproduce

To reproduce you need to downgrade to 1.3.13 and try social auth and sso login with Google OIDC or any other provider (using SSO plugin).

Current vs. Expected behavior

This is what browser shows after auth callback on 1.3.24

http://localhost:8080/api/error?error=state_mismatch sent back an error.

Error code: 404 Not Found

    Check to make sure you’ve typed the website address correctly.

On 1.3.13 callback works as expected and cookie session is set.

What version of Better Auth are you using?

1.3.24

System info

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

Additional context

No response

Originally created by @rohovskoi on GitHub (Oct 2, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5055 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce To reproduce you need to downgrade to 1.3.13 and try social auth and sso login with Google OIDC or any other provider (using SSO plugin). ### Current vs. Expected behavior This is what browser shows after auth callback on 1.3.24 ``` http://localhost:8080/api/error?error=state_mismatch sent back an error. Error code: 404 Not Found Check to make sure you’ve typed the website address correctly. ``` On 1.3.13 callback works as expected and cookie session is set. ### What version of Better Auth are you using? 1.3.24 ### System info ```bash . ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_

GiteaMirror added the locked label 2026-04-13 06:06:28 -05:00

GiteaMirror closed this issue

2026-04-13 06:06:29 -05:00

GiteaMirror commented

2026-04-13 06:06:30 -05:00

@dosubot[bot] commented on GitHub (Oct 2, 2025):

This is a known breaking change in Better Auth 1.3.23 and later: the OAuth "state" parameter and its cookies must now be set on the client side, not the server. If you trigger social or SSO sign-in (like Google OIDC) from a server action or API route, you'll get a state_mismatch error on callback, and the session won't be set. The fix is to move your sign-in initiation (e.g., signIn() or equivalent) to the client side and use the authClient directly for social/SSO flows. Downgrading to 1.3.13 works because this requirement was introduced after that version. More details and solutions are discussed here and here.

Also, double-check your callback URL configuration: the OAuth provider's redirect URI should point to your API callback endpoint, but the callbackURL in your app code should point to a user-facing route, not the API endpoint, to avoid double-callbacks and 404s (details).

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 2, 2025):  This is a known breaking change in Better Auth 1.3.23 and later: the OAuth "state" parameter and its cookies must now be set on the client side, not the server. If you trigger social or SSO sign-in (like Google OIDC) from a server action or API route, you'll get a `state_mismatch` error on callback, and the session won't be set. The fix is to move your sign-in initiation (e.g., `signIn()` or equivalent) to the client side and use the `authClient` directly for social/SSO flows. Downgrading to 1.3.13 works because this requirement was introduced after that version. More details and solutions are discussed [here](https://github.com/better-auth/better-auth/issues/4969) and [here](https://github.com/better-auth/better-auth/issues/4998). Also, double-check your callback URL configuration: the OAuth provider's redirect URI should point to your API callback endpoint, but the `callbackURL` in your app code should point to a user-facing route, not the API endpoint, to avoid double-callbacks and 404s ([details](https://github.com/better-auth/better-auth/issues/3488)).  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/7ac6bb45-95c5-4aa6-b154-1065ea063017?feedback_type=other)  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5055)

GiteaMirror commented

2026-04-13 06:06:31 -05:00

@rohovskoi commented on GitHub (Oct 2, 2025):

@dosu Can i set it without authClient on my client?

@rohovskoi commented on GitHub (Oct 2, 2025): @dosu Can i set it without authClient on my client?

GiteaMirror commented

2026-04-13 06:06:32 -05:00

@dosubot[bot] commented on GitHub (Oct 2, 2025):

No, in Better Auth v1.3.24+, you can't set up social or SSO authentication on the client without using authClient. The authClient is required because it handles the OAuth state parameter and cookie logic on the client side, which is necessary to avoid state_mismatch errors after the breaking change in v1.3.23+. There are no supported alternatives or lower-level APIs for this—authClient is the only way to correctly initiate these flows on the client. If you previously started social/SSO sign-in from the server, you'll need to move that logic to the client and use authClient directly.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 2, 2025):  No, in Better Auth v1.3.24+, you can't set up social or SSO authentication on the client without using authClient. The authClient is required because it handles the OAuth state parameter and cookie logic on the client side, which is necessary to avoid state_mismatch errors after the breaking change in v1.3.23+. There are no supported alternatives or lower-level APIs for this—authClient is the only way to correctly initiate these flows on the client. If you previously started social/SSO sign-in from the server, you'll need to move that logic to the client and use authClient directly.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0faa4047-c910-4bbb-a6b9-21146c5b207e?feedback_type=other)  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5055)

GiteaMirror commented

2026-04-13 06:06:33 -05:00

@rohovskoi commented on GitHub (Oct 2, 2025):

@dosu

does this affect only social/SSO sign-in or all endpoints?

@rohovskoi commented on GitHub (Oct 2, 2025): @dosu does this affect only social/SSO sign-in or all endpoints?

GiteaMirror commented

2026-04-13 06:06:34 -05:00

@dosubot[bot] commented on GitHub (Oct 2, 2025):

This change only affects social and SSO sign-in flows that use OAuth or OIDC providers—specifically, any authentication flow that relies on the OAuth "state" parameter and its cookies. Other endpoints, like magic link or email/password authentication, are not impacted by this client-side state/cookie handling change in Better Auth v1.3.23+; issues and documentation consistently reference only social/SSO flows as affected.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 2, 2025):  This change only affects social and SSO sign-in flows that use OAuth or OIDC providers—specifically, any authentication flow that relies on the OAuth "state" parameter and its cookies. Other endpoints, like magic link or email/password authentication, are not impacted by this client-side state/cookie handling change in Better Auth v1.3.23+; issues and documentation consistently reference only social/SSO flows as affected.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/062ed457-5e9e-4e8b-92c1-59d7bbfac212?feedback_type=other)  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5055)

GiteaMirror commented

2026-04-13 06:06:34 -05:00

@rohovskoi commented on GitHub (Oct 2, 2025):

@dosu

show me how I correctly create authClient instance and then use these endpoints / methods.

@rohovskoi commented on GitHub (Oct 2, 2025): @dosu show me how I correctly create authClient instance and then use these endpoints / methods.

GiteaMirror commented

2026-04-13 06:06:35 -05:00

@dosubot[bot] commented on GitHub (Oct 2, 2025):

Here's how to correctly create an authClient instance and use it for social/SSO sign-in in Better Auth v1.3.24+:

Install the client library:
```
npm install better-auth/client
```

Import and configure authClient:

import { createAuthClient } from 'better-auth/client'
import { genericOAuthClient } from 'better-auth/client/plugins'

const authClient = createAuthClient({
  baseURL: 'https://your-auth-server.com/api/auth', // your API endpoint
  fetchOptions: { credentials: 'include' }, // ensures cookies are sent
  plugins: [genericOAuthClient()]
})

Initiate social/SSO sign-in (client-side only):

// Example: Google sign-in button handler
await authClient.signIn.social({
  provider: 'google',
  callbackURL: '/dashboard' // user-facing route after auth
})

You can use other providers by changing provider to e.g. 'github', 'microsoft', etc. Example.

Session management:
After sign-in, use the useSession hook (or method) from your authClient instance to access session data, loading state, and errors:
```
const { data: session, isPending, error } = authClient.useSession()
```

Important config notes:

Your OAuth provider's redirect URI should be set to your API callback endpoint (e.g., /api/auth/oauth2/callback/google).
The callbackURL in your client code should be a user-facing route (e.g., /dashboard), not the API endpoint.
Make sure CORS and cookies are configured correctly: credentials: 'include' on the client, SameSite=None and Secure=true on the server.
The plugins array in your client config must match what's enabled on your backend.

Common pitfalls: Calling sign-in from the server or misconfiguring callback URLs will cause state_mismatch errors in v1.3.24+—always initiate social/SSO sign-in from the client using authClient. Reference

Let me know if you need a full example for a specific framework or provider!

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 2, 2025):  Here's how to correctly create an authClient instance and use it for social/SSO sign-in in Better Auth v1.3.24+: 1. **Install the client library**: ``` npm install better-auth/client ``` 2. **Import and configure authClient**: ```typescript import { createAuthClient } from 'better-auth/client' import { genericOAuthClient } from 'better-auth/client/plugins' const authClient = createAuthClient({ baseURL: 'https://your-auth-server.com/api/auth', // your API endpoint fetchOptions: { credentials: 'include' }, // ensures cookies are sent plugins: [genericOAuthClient()] }) ``` 3. **Initiate social/SSO sign-in (client-side only)**: ```typescript // Example: Google sign-in button handler await authClient.signIn.social({ provider: 'google', callbackURL: '/dashboard' // user-facing route after auth }) ``` You can use other providers by changing `provider` to e.g. `'github'`, `'microsoft'`, etc. [Example](https://github.com/better-auth/better-auth/blob/8fbb921fb319ba2e9d079ead0de545643fd595b9/demo/nextjs/components/sign-in.tsx). 4. **Session management**: After sign-in, use the `useSession` hook (or method) from your authClient instance to access session data, loading state, and errors: ```typescript const { data: session, isPending, error } = authClient.useSession() ``` **Important config notes**: - Your OAuth provider's redirect URI should be set to your API callback endpoint (e.g., `/api/auth/oauth2/callback/google`). - The `callbackURL` in your client code should be a user-facing route (e.g., `/dashboard`), not the API endpoint. - Make sure CORS and cookies are configured correctly: `credentials: 'include'` on the client, `SameSite=None` and `Secure=true` on the server. - The plugins array in your client config must match what's enabled on your backend. **Common pitfalls**: Calling sign-in from the server or misconfiguring callback URLs will cause `state_mismatch` errors in v1.3.24+—always initiate social/SSO sign-in from the client using authClient. [Reference](https://github.com/better-auth/better-auth/issues/4998) Let me know if you need a full example for a specific framework or provider!  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/aecfcb0a-b270-4689-a7c2-dcc455ab7908?feedback_type=other)  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5055)

GiteaMirror commented

2026-04-13 06:06:36 -05:00

@rohovskoi commented on GitHub (Oct 2, 2025):

@dosu

Social Auth Endpoints

    POST /api/auth/sign-in/social - Initiates social OAuth flow
    GET /api/auth/callback/{providerId} - Handles OAuth provider callbacks

SSO Plugin Endpoints

When using the SSO plugin, additional endpoints are added index.ts:80-96 :

    POST /api/auth/sso/register - Register OIDC/SAML providers
    GET /api/auth/sso/callback/{providerId} - Handle SSO callbacks
    GET /api/auth/sso/saml2/sp/metadata - SAML metadata endpoint
    POST /api/auth/sso/saml2/callback/{providerId} - SAML callback endpoint

Are all of these endpoints affected or only callback ones?

Which endpoint implementations can I leave for my server API to handle and which I MUST implement with authClient on the client (starting the call with it, instead of simple fetch('myBackendUrl/someBetterAuthEndpoint') ).

Keep in mind that I want to leave as much as possible on the server to handle auth.

I'm using Express. So also tell me which endpoints I MUST expose for this to work.

@rohovskoi commented on GitHub (Oct 2, 2025): @dosu ```md Social Auth Endpoints POST /api/auth/sign-in/social - Initiates social OAuth flow GET /api/auth/callback/{providerId} - Handles OAuth provider callbacks SSO Plugin Endpoints When using the SSO plugin, additional endpoints are added index.ts:80-96 : POST /api/auth/sso/register - Register OIDC/SAML providers GET /api/auth/sso/callback/{providerId} - Handle SSO callbacks GET /api/auth/sso/saml2/sp/metadata - SAML metadata endpoint POST /api/auth/sso/saml2/callback/{providerId} - SAML callback endpoint ``` Are all of these endpoints affected or only callback ones? Which endpoint implementations can I leave for my server API to handle and which I **MUST** implement with `authClient` on the client (starting the call with it, instead of simple fetch('myBackendUrl/someBetterAuthEndpoint') ). Keep in mind that I want to leave as much as possible on the server to handle auth. I'm using Express. So also tell me which endpoints I **MUST** expose for this to work.

GiteaMirror commented

2026-04-13 06:06:37 -05:00

@dosubot[bot] commented on GitHub (Oct 2, 2025):

Only the endpoints that initiate social/SSO sign-in flows—specifically, those that rely on the OAuth "state" parameter—are affected by the client-side state/cookie change in Better Auth v1.3.23+.

For your list:

POST /api/auth/sign-in/social and POST /api/auth/sign-in/sso (not shown above, but part of SSO flows) must be called from the client using authClient. This is required so the OAuth state cookie is set in the browser; calling these from the server or via a plain fetch will cause state_mismatch errors on callback [source].
GET /api/auth/callback/{providerId} and GET /api/auth/sso/callback/{providerId} are server-handled. You must expose these in your Express API to handle OAuth/OIDC/SSO callbacks. They validate the state/cookie and complete the login [source].
POST /api/auth/sso/register, GET /api/auth/sso/saml2/sp/metadata, and POST /api/auth/sso/saml2/callback/{providerId} are not affected by the client-side state/cookie change. You can keep these fully server-handled in Express [source].

Summary for Express:
You must expose all callback endpoints (OAuth/OIDC and SSO) and SAML endpoints on your Express server. But you must initiate social/SSO sign-in from the client using authClient—not via a server action or direct fetch—so the state cookie is set correctly. All other endpoints (like provider registration, SAML metadata, SAML callback) can remain server-side.

If you want to keep as much logic as possible on the server, you can still handle all callbacks, session management, and SAML flows in Express, but the initial sign-in for social/SSO must start on the client with authClient [source].

Watch out for callback URL misconfigurations: the OAuth provider's redirect URI should point to your API callback endpoint, but the callbackURL in your client code should be a user-facing route, not the API endpoint [source].

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Oct 2, 2025):  Only the endpoints that initiate social/SSO sign-in flows—specifically, those that rely on the OAuth "state" parameter—are affected by the client-side state/cookie change in Better Auth v1.3.23+. For your list: - POST `/api/auth/sign-in/social` and POST `/api/auth/sign-in/sso` (not shown above, but part of SSO flows) **must be called from the client using `authClient`**. This is required so the OAuth state cookie is set in the browser; calling these from the server or via a plain fetch will cause `state_mismatch` errors on callback [[source]](https://github.com/better-auth/better-auth/issues/4998). - GET `/api/auth/callback/{providerId}` and GET `/api/auth/sso/callback/{providerId}` are **server-handled**. You must expose these in your Express API to handle OAuth/OIDC/SSO callbacks. They validate the state/cookie and complete the login [[source]](https://github.com/better-auth/better-auth/blob/8fbb921fb319ba2e9d079ead0de545643fd595b9/packages/better-auth/src/api/routes/callback.ts). - POST `/api/auth/sso/register`, GET `/api/auth/sso/saml2/sp/metadata`, and POST `/api/auth/sso/saml2/callback/{providerId}` are **not affected** by the client-side state/cookie change. You can keep these fully server-handled in Express [[source]](https://github.com/better-auth/better-auth/blob/8fbb921fb319ba2e9d079ead0de545643fd595b9/packages/better-auth/src/plugins/sso/index.ts). **Summary for Express:** You must expose all callback endpoints (OAuth/OIDC and SSO) and SAML endpoints on your Express server. But you must initiate social/SSO sign-in from the client using `authClient`—not via a server action or direct fetch—so the state cookie is set correctly. All other endpoints (like provider registration, SAML metadata, SAML callback) can remain server-side. If you want to keep as much logic as possible on the server, you can still handle all callbacks, session management, and SAML flows in Express, but the initial sign-in for social/SSO must start on the client with `authClient` [[source]](https://github.com/better-auth/better-auth/issues/4969). Watch out for callback URL misconfigurations: the OAuth provider's redirect URI should point to your API callback endpoint, but the `callbackURL` in your client code should be a user-facing route, not the API endpoint [[source]](https://github.com/better-auth/better-auth/issues/4998).  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/e6548666-f1bc-4748-aba0-8035fcc7a100?feedback_type=other)  [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5055)

GiteaMirror commented

2026-04-13 06:06:37 -05:00

@rohovskoi commented on GitHub (Oct 2, 2025):

@dosu

Is magic link or any other plugins also affected?

@rohovskoi commented on GitHub (Oct 2, 2025): @dosu Is magic link or any other plugins also affected?

Sign in to join this conversation.

Branches Tags

changeset-release/next

main

2026-08-04/fix/align-better-call-types

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-404d92f9cb

dependabot/github_actions/github-actions-42c4bc6a62

2026-07-31/chore/bump-better-call

2026-07-30/chore/upgrade-better-call

2026-07-30/fix/nextjs-rsc-session-refresh

feat/1-7-migration-validation

2026-07-29/refactor/centralize-placeholder-email-generation

refactor/oauth-client-application-type

2026-07-28/fix/anonymous-oauth-proxy-linking

feat/agent-feedback-endpoint

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

feat/oauth-provider-remove-silence-warnings

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

feat/oauth-provider-custom-subject

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#10154