by Kastro
Paper/Archive/CVE-2026-67336

CVE-2026-67336

better-auth better-auth — better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

EPSS 0.2%CVSS 9.4
critical.is priorityof 100
31
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 14.7.147 × 202.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

Affected

ProductAffectedFixed inSource
better-auth< 1.6.111.6.11CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4writeupvulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider