CVE-2026-67336
CVE-2026-67336 · better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
This page contains facts from public vulnerability sources. Check the original advisory before updating.
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
CVSS 9.4 · Critical · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
better-auth
- Versions
- ≥ 0, < 1.6.11: Affected (semver)
- 1.6.11: Not affected (semver)
Update to 1.6.11
better-auth npm
- Affected ranges
- SEMVER: < 1.6.11
Update to 1.6.11