Medium severity · published Aug 1, 2026
CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
oauth-provider · better-auth
1.4.8 before 1.7.0-beta.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67332
vendor-advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
third-party-advisory
https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass
More from oauth-provider
8.1
CVE-2026-53517
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
6.5
CVE-2026-41427
Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients