CVE-2026-67327— better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
Affected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | better-auth | 1.1.3< 1.6.22 | affected |
1.6.22 | unaffected | ||
1.7.0-beta.0< 1.7.0-beta.10 | affected | ||
1.7.0-beta.10 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67327
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
Source: CVE Program / CVE List V5
Vulnerability Description
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
better-auth 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
better-auth是better-auth团队开源的一个身份验证框架。 better-auth 1.1.3版本至1.6.22之前版本和1.7.0-beta.0版本至1.7.0-beta.10之前版本存在授权问题漏洞，该漏洞源于预账户劫持问题，当启用邮箱/密码注册时，攻击者使用受害者邮箱注册账户并设置密码，合法用户通过magic-link或email-OTP无密码流程登录后原有密码未被清除，导致账户被接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | better-auth | 1.1.3 ~ 1.6.22 | - | |
| better-auth | better-auth | 1.7.0-beta.0 ~ 1.7.0-beta.10 | - |
II. Public POCs for CVE-2026-67327
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7974 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-67327
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-67327 (2)
Same Patch Batch · better-auth · 2026-08-01 · 14 CVEs total
| CVE-2026-67330 | 9.9 CRITICAL | better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision |
| CVE-2026-67336 | 8.7 HIGH | better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider |
| CVE-2026-67331 | 8.3 HIGH | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67328 | 8.1 HIGH | @better-auth/sso before 1.6.21 Account Takeover via SSO |
| CVE-2026-67333 | 7.2 HIGH | better-auth before 1.6.13 Stored XSS via javascript redirect_uri |
| CVE-2026-67329 | 7.1 HIGH | @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription |
| CVE-2025-71403 | 7.1 HIGH | better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass |
| CVE-2026-67337 | 6.5 MEDIUM | better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache |
| CVE-2026-67332 | 6.4 MEDIUM | @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67335 | 5.3 MEDIUM | better-auth before 1.6.2 OAuth State Validation Bypass |
| CVE-2025-71404 | 5.1 MEDIUM | better-auth before 1.1.16 Reflected XSS via error parameter |
| CVE-2026-67334 | 3.8 LOW | better-auth Stale Sessions Persist After User Deletion |
| CVE-2025-71402 | 2.0 LOW | better-auth before 1.4.0 Session Revocation via Forged Cookie |
IV. Related Vulnerabilities
Same product: better-auth
- CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS - CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3 - CVE-2026-67337
better-auth before 1.4.9 Two-Factor Authentication Bypass vi - CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults vi - CVE-2026-67334
better-auth Stale Sessions Persist After User Deletion
Same vendor: better-auth
- CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS - CVE-2025-71400
better-auth passkey before 1.4.0 IDOR via delete-passkey - CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3 - CVE-2026-67329
@better-auth/stripe before 1.6.21 Authorization Bypass via O - CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults vi
Same weakness: CWE-287
- CVE-2026-18610
NewType WebEIP EIP_Com_FileList.aspx improper authentication - CVE-2026-18651
389-ds-base: 389-ds-base: sasl plain bind installs connectio - CVE-2026-67335
better-auth before 1.6.2 OAuth State Validation Bypass - CVE-2026-18215
Keycloak-services: keycloak-services: microsoft external acc - CVE-2026-14541
Authentication Bypass and Audience Confusion in MCP Toolbox
V. Comments for CVE-2026-67327
No comments yet