CVE-2026-67332 Overview
CVE-2026-67332 affects the @better-auth/oauth-provider package in versions before 1.7.0-beta.4. The provider fails to bind an access token's audience claim to the original authorization grant. As a result, clients can request tokens whose audience targets resource servers that the underlying authorization never covered.
An attacker who completes a legitimate OAuth flow can obtain access tokens for unrelated resources. This bypasses the authorization boundaries the resource owner intended to enforce. The flaw maps to improper authorization [CWE-285].
Critical Impact
Authenticated clients can obtain OAuth access tokens for resource servers outside the granted authorization scope, breaking multi-audience isolation guarantees.
Affected Products
- @better-auth/oauth-provider versions prior to 1.7.0-beta.4
- Applications embedding the Better Auth OAuth provider for multi-resource token issuance
- Downstream resource servers relying on the audience claim for access decisions
Discovery Timeline
- 2026-08-01 - CVE-2026-67332 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67332
Vulnerability Analysis
The @better-auth/oauth-provider package implements an OAuth 2.0 authorization server. During token issuance, the provider accepts an audience parameter from the client without verifying that the requested audience was part of the original authorization grant.
The access token generation path does not cross-check the aud claim against the resource identifiers approved during the /authorize step. A client that completes any valid authorization flow can then request a token targeting an arbitrary resource server. Resource servers that trust the audience claim will accept these tokens as legitimately granted.
The issue is a business-logic authorization defect rather than a cryptographic or memory-safety flaw. Token signatures remain valid, so downstream validation checks pass while the underlying consent is violated.
Root Cause
The root cause is missing binding between the authorization grant record and the audience claim written into the issued access token. The provider treats audience as a client-supplied token request parameter instead of a property fixed at authorization time. This omission maps to [CWE-285] Improper Authorization.
Attack Vector
Exploitation requires an attacker to hold valid client credentials or complete a normal user-consent flow. The attacker requests an access token specifying an audience for a resource server that was never authorized. The provider issues a signed token with the attacker-controlled audience. The attacker presents the token to the targeted resource server, which honors the audience and grants access. Refer to the GitHub Security Advisory and the VulnCheck Advisory for provider-specific request details.
Detection Methods for CVE-2026-67332
Indicators of Compromise
- Access tokens issued with aud values that do not appear in the corresponding authorization grant record.
- Token requests to /oauth/token containing resource or audience parameters inconsistent with prior /authorize calls from the same client.
- Resource server access logs showing token acceptance from clients that never completed a scoped consent for that server.
Detection Strategies
- Correlate authorization server grant logs with token issuance logs and alert when the token audience is absent from the grant's approved resource list.
- Inspect JWT access tokens at resource servers and reject any aud value not registered as an authorized downstream for the issuing client.
- Baseline per-client audience patterns and flag first-seen audiences for anomaly review.
Monitoring Recommendations
- Enable verbose logging of the /authorize and /token endpoints in @better-auth/oauth-provider deployments.
- Forward OAuth provider and resource server logs to a central analytics tier for cross-endpoint correlation.
- Track token-to-grant binding metrics and alert on mismatched audience issuance events.
How to Mitigate CVE-2026-67332
Immediate Actions Required
- Upgrade @better-auth/oauth-provider to version 1.7.0-beta.4 or later.
- Rotate signing keys and revoke outstanding access and refresh tokens issued by vulnerable provider instances.
- Audit resource server logs for tokens presented with audiences outside expected client scopes.
- Enforce strict audience allowlists on each resource server as a defense-in-depth control.
Patch Information
The maintainers fixed the flaw in @better-auth/oauth-provider version 1.7.0-beta.4. The patch binds the access token audience to the authorization grant so that the token endpoint refuses audience values not approved during /authorize. Full technical notes are available in the GitHub Security Advisory GHSA-p2fr-6hmx-4528.
Workarounds
- Restrict the set of registered resource identifiers per OAuth client to the minimum required.
- Validate the aud claim at every resource server against a static allowlist tied to the client identifier.
- Disable dynamic audience or resource parameters at the token endpoint until the upgrade is complete.
- Shorten access token lifetimes to reduce the window in which mis-audienced tokens remain valid.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
