Login Request a demo
High severity · published Aug 1, 2026
CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
before 1.6.11 · source: vendor
Affected product
BE
better-auth
better-auth
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67336
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67336
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4
www.vulncheck.com
https://www.vulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins