Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-67336— better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Quick assessment

Affected

better-auth better-auth

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

better-auth是better-auth团队开源的一个身份验证框架。 better-auth 1.6.11之前版本存在加密问题漏洞，该漏洞源于oidcProvider和mcp插件存在不安全的加密默认值，宣传none算法并默认接受明文PKCE，可能导致攻击者利用算法协商接受未签名令牌或拦截授权码。

CVSS 8.7 · High EPSS 0.24% · P13 Updated Aug 03, 2026

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 2

Vendor	Product	Version Range	Status
better-auth	better-auth	`< 1.6.11`	affected
		`1.6.11`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-67336

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Source: CVE Program / CVE List V5

Vulnerability Description

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用已被攻破或存在风险的密码学算法

Source: CVE Program / CVE List V5

Vulnerability Title

better-auth 加密问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
better-auth	better-auth	0 ~ 1.6.11	-

II. Public POCs for CVE-2026-67336

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 6354 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-67336

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-67336 (1)

🔗 Insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default · Advisory · better-auth/better-auth · GitHub Read full article vendor-advisory

Other References for CVE-2026-67336 (1)

🔗 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-67336

Same Patch Batch · better-auth · 2026-08-01 · 14 CVEs total

CVE-2026-67330	9.9 CRITICAL	better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
CVE-2026-67327	8.3 HIGH	better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-67331	8.3 HIGH	better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67328	8.1 HIGH	@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2026-67333	7.2 HIGH	better-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-67329	7.1 HIGH	@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2025-71403	7.1 HIGH	better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2026-67337	6.5 MEDIUM	better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
CVE-2026-67332	6.4 MEDIUM	@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67335	5.3 MEDIUM	better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2025-71404	5.1 MEDIUM	better-auth before 1.1.16 Reflected XSS via error parameter
CVE-2026-67334	3.8 LOW	better-auth Stale Sessions Persist After User Deletion
CVE-2025-71402	2.0 LOW	better-auth before 1.4.0 Session Revocation via Forged Cookie

IV. Related Vulnerabilities

Same product: better-auth

Same vendor: better-auth

Same weakness: CWE-327

V. Comments for CVE-2026-67336

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-67336— better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-67336

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-67336

III. Intelligence Information for CVE-2026-67336

Vendor Advisories for CVE-2026-67336 (1)

Other References for CVE-2026-67336 (1)

Same Patch Batch · better-auth · 2026-08-01 · 14 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-67336

Leave a comment