CVE-2026-67336CWE-327

CVE-2026-67336

High · published August 1, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-08-01T17:17Z
References (2)
https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4 · [email protected]https://www.vulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider · [email protected]
EPSS history
Timeline
  • 01 AUG 12:22Z
    better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
    cvelistv5