Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Better Auth's OIDC Server Has Insecure Defaults

CVE-2026-67336 · published 3 months ago
Summary

If you use Better Auth at an outdated version, your application's OIDC server may be insecure. This is because the older version of Better Auth allows insecure default settings for OpenID Connect (OIDC). You should update to the latest version of Better Auth to fix this issue. If updating is not possible, consider migrating to the newer package or applying workarounds.

What to do
  • Update GitHub Actions better-auth to version 1.6.11.
  • Update better-auth better-auth to version 1.6.11 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions better-auth < 1.6.11
Fix: upgrade to 1.6.11
– better-auth better-auth < 1.6.11
Original advisory text
better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-327Use of a Broken Cryptographic Algorithm
CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published1 Aug 2026
Updated4 Nov 2026
First seen7 Jul 2026
Sources
CVE-2026-67336 · MITRE
CVE-2026-67336 · NVD
GHSA-9h47-pqcx-hjr4 · GHSA
CVE-2026-67336 · OSV
Track software like this
Free during beta