CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
- State
- Published
- Severity
- 9.4 Critical
- Published
- Aug 1, 2026
- Updated
- Aug 3, 2026
- Reserved
- Jul 29, 2026
Description
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected Products
| Product | Versions |
|---|---|
better-authbetter-auth |
|
References
- GitHub Security Advisory (GHSA-9h47-pqcx-hjr4)vendor-advisory
- VulnCheck Advisory: better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.