CVE-2026-67335: better-auth OAuth Auth Bypass Vulnerability

CVE-2026-67335 Overview

CVE-2026-67335 is an authentication bypass vulnerability in better-auth versions before 1.6.2. The library fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without Proof Key for Code Exchange (PKCE). Attackers can forge the state parameter and supply an attacker-controlled authorization code. This allows them to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles. The flaw maps to CWE-287: Improper Authentication and affects OAuth login flows in applications built on better-auth.

Critical Impact
Attackers can hijack authenticated sessions or link attacker-controlled identities to victim accounts through forged OAuth state parameters.

Affected Products

better-auth versions prior to 1.6.2
Applications using better-auth OAuth flows with cookie-backed state storage
Deployments that do not enable PKCE for OAuth authorization

Discovery Timeline

2026-08-01 - CVE-2026-67335 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67335

Vulnerability Analysis

The vulnerability resides in the OAuth 2.0 authorization code flow implementation in better-auth. During a standard OAuth exchange, the client generates a random state parameter, stores it server-side or in a signed cookie, and validates it against the value returned by the identity provider on callback. This binding prevents an attacker from injecting an authorization code obtained through their own OAuth session into a victim's browser.

In better-auth releases before 1.6.2, the callback handler does not compare the incoming state value against the nonce stored in the state cookie when PKCE is disabled. An attacker who initiates their own OAuth authorization at the identity provider can capture a valid authorization code, then deliver a callback URL containing that code and an arbitrary state to a victim or to the application directly.

Because PKCE was absent and state validation was skipped, the server accepts the authorization code, exchanges it for tokens tied to the attacker's identity, and issues a session cookie. Depending on the application flow, this either logs the victim in as the attacker or links the attacker's external identity provider account to the victim's local profile, creating a persistent backdoor for account takeover.

Root Cause

The root cause is a missing equality check between the returned state query parameter and the nonce value stored in the state cookie. The code path for cookie-backed state without PKCE bypassed the validation branch that enforces this comparison.

Attack Vector

Exploitation requires network access to the target application and user interaction, typically clicking a crafted callback link. The attacker first performs an OAuth authorization at the identity provider to obtain an authorization code, then constructs a callback URL to the vulnerable application containing that code paired with a forged state value. Refer to the GitHub Security Advisory GHSA-wxw3-q3m9-c3jr for the full technical breakdown.

Detection Methods for CVE-2026-67335

Indicators of Compromise

OAuth callback requests where the state parameter does not match any value previously issued by the application.
Newly created account links between local user profiles and external identity provider accounts that users did not initiate.
Session creation events immediately following an OAuth callback from an unfamiliar client IP or user agent.

Detection Strategies

Audit better-auth version strings in application dependency manifests (package.json, pnpm-lock.yaml, yarn.lock) for versions below 1.6.2.
Log every OAuth callback with the returned state, code, source IP, and resulting user ID for retrospective correlation.
Alert when a single external identity provider sub claim becomes linked to multiple distinct local user accounts.

Monitoring Recommendations

Monitor authentication logs for successful OAuth logins where the state cookie was absent or malformed at callback time.
Track account linking events and require step-up authentication when a new external identity is bound to an existing profile.
Ingest application authentication telemetry into a central data lake to correlate OAuth anomalies across services.

How to Mitigate CVE-2026-67335

Immediate Actions Required

Upgrade better-auth to version 1.6.2 or later across all applications and services.
Enable PKCE for every OAuth provider configuration where the identity provider supports it.
Invalidate active sessions and force re-authentication after upgrading to eliminate any sessions created through the flawed flow.
Review account linkage records and unlink any external identities that cannot be attributed to legitimate user activity.

Patch Information

The issue is resolved in better-auth1.6.2. The patch reintroduces the state-to-nonce equality check on the cookie-backed OAuth callback path. Full remediation details are documented in the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

If immediate upgrade is not possible, configure OAuth providers to require PKCE, which enforces an additional code_verifier check that mitigates state forgery.
Switch state storage from cookie-backed to a server-side session store that enforces strict nonce validation.
Add a reverse proxy or middleware rule that rejects OAuth callbacks lacking a matching state cookie.

bash

# Configuration example
npm install better-auth@^1.6.2

# Enable PKCE in provider configuration
# betterAuth({
#   socialProviders: {
#     github: { clientId, clientSecret, pkce: true }
#   }
# })