CVE-2026-67336 CRITICAL

CVE-2026-67336: better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Vendor Better-Auth
Product better-auth
Weakness CWE-327 · Broken crypto
Published August 1, 2026
Last update August 3, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

Key dates

02Disclosure timeline

August 1, 2026 CVE published
August 3, 2026 Record updated