CVE-2026-67327: better-auth Auth Bypass Vulnerability

CVE-2026-67327 Overview

CVE-2026-67327 is a pre-account hijacking flaw in the better-auth authentication library. Affected versions are >= 1.1.3 and < 1.6.22, plus pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10. The vulnerability exists when open email and password registration is enabled alongside magic-link or email-OTP passwordless sign-in. An attacker registers an unverified account using a victim's email address and an attacker-chosen password. When the victim later authenticates through the passwordless flow, the account is verified without invalidating the attacker's pre-existing password or sessions. The issue is tracked as [CWE-287] Improper Authentication and fixed in 1.6.22 and 1.7.0-beta.10.

Critical Impact
An unauthenticated attacker gains persistent access to a victim's account once the victim signs in via magic link or email OTP.

Affected Products

better-auth versions >= 1.1.3 and < 1.6.22
better-auth pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10
Applications enabling open email/password registration together with magic-link or email-OTP sign-in

Discovery Timeline

2026-08-01 - CVE-2026-67327 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67327

Vulnerability Analysis

The flaw is a classic pre-account hijacking pattern against a passwordless verification path. The attacker acts before the legitimate user, registering an account with the victim's email and setting a known password. The account is created in an unverified state, but credentials are stored.

When the legitimate owner initiates sign-in through the magic-link or email-OTP flow, better-auth treats the successful challenge as proof of email ownership. It marks the account verified but does not remove the previously stored password or terminate any sessions bound to the attacker-controlled credentials.

The attacker's password remains valid against the same account. Both parties can now authenticate, giving the attacker persistent access without further user interaction.

Root Cause

The root cause is missing account-state reconciliation on first successful passwordless verification. The verification handler should treat any credentials or sessions established prior to email verification as untrusted, but instead leaves them intact. This maps to [CWE-287] Improper Authentication.

Attack Vector

Exploitation requires network access to the registration and sign-in endpoints and depends on the victim eventually using the passwordless flow. The attacker needs no privileges, and user interaction is limited to the victim completing a normal magic-link or OTP login. No exploitation code is required beyond standard API calls to the vulnerable endpoints. See the GitHub Security Advisory and the VulnCheck Advisory on Account Takeover for the vendor-confirmed behavior.

Detection Methods for CVE-2026-67327

Indicators of Compromise

Accounts that transitioned from unverified to verified via magic link or OTP while still holding a password credential set from a different IP or session.
Concurrent active sessions on the same account originating from distinct user agents or geolocations immediately after first verification.
Password-based logins occurring shortly after a magic-link or email-OTP verification event for a newly verified account.

Detection Strategies

Query authentication logs for accounts where emailVerified flipped to true while a pre-existing password credential row was present.
Correlate registration events with subsequent passwordless verification events by the same email but different client fingerprints.
Alert on accounts where the first successful password login follows an email-OTP or magic-link verification within a short window.

Monitoring Recommendations

Enable verbose audit logging on better-auth registration, verification, and session creation events.
Forward authentication telemetry to a centralized SIEM or data lake for cross-session correlation.
Track version metadata of deployed better-auth packages in software bills of materials to identify vulnerable instances.

How to Mitigate CVE-2026-67327

Immediate Actions Required

Upgrade better-auth to 1.6.22 or 1.7.0-beta.10 or later.
Invalidate all active sessions on accounts that were created but not verified prior to the upgrade.
Force a password reset for accounts that existed in an unverified state with a stored password.

Patch Information

The maintainers fixed the vulnerability in better-auth1.6.22 and pre-release 1.7.0-beta.10. The patch ensures that successful magic-link or email-OTP verification of a previously unverified account clears pre-existing credentials and revokes prior sessions. Refer to the GitHub Security Advisory GHSA-qq9h-g4jm-xgf3 for release notes.

Workarounds

Disable open email/password registration until the upgrade is deployed, permitting only invite-based or verified sign-up flows.
Require email verification to complete before any password credential is persisted for a new account.
Manually purge unverified accounts older than a short threshold and revoke their sessions on a scheduled job.

bash

# Configuration example
npm install better-auth@^1.6.22
# or for pre-release channel
npm install better-auth@1.7.0-beta.10