CVE-2026-67336 Overview
CVE-2026-67336 affects better-auth versions before 1.6.11. The oidcProvider and mcp plugins ship with insecure cryptographic defaults. The plugins advertise the none algorithm and accept plain Proof Key for Code Exchange (PKCE) by default. Attackers can exploit algorithm negotiation to accept unsigned tokens. They can also intercept authorization codes when PKCE plain is used instead of the required S256 method. The weakness is categorized under [CWE-327: Use of a Broken or Risky Cryptographic Algorithm].
Critical Impact
Attackers can bypass token signature validation and hijack OAuth authorization flows, leading to full account takeover and unauthorized access to protected resources.
Affected Products
- better-auth versions prior to 1.6.11
- oidcProvider plugin shipped with better-auth
- mcp plugin shipped with better-auth
Discovery Timeline
- 2026-08-01 - CVE-2026-67336 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67336
Vulnerability Analysis
The vulnerability stems from two insecure defaults in the oidcProvider and mcp plugins. First, the plugins advertise the none algorithm in JSON Web Token (JWT) metadata. A relying party that follows the advertised algorithm list may accept unsigned tokens. This allows an attacker to forge identity tokens without possessing any signing key.
Second, the plugins accept plain PKCE by default. The OAuth 2.1 specification requires the S256 PKCE method to bind an authorization request to the token exchange. When PKCE plain is accepted, the code_verifier is transmitted in cleartext form and equals the code_challenge. An attacker who intercepts either value can complete the authorization code exchange.
Combined, these defaults break the two primary integrity controls in an OpenID Connect (OIDC) authorization flow: token signature verification and authorization code binding.
Root Cause
The plugins apply cryptographic defaults that do not enforce a secure minimum. The metadata advertises the none JWS algorithm alongside stronger algorithms, and PKCE method negotiation defaults to accepting plain. Neither behavior aligns with current OAuth 2.1 and OpenID Connect security guidance.
Attack Vector
An attacker operates over the network without prior authentication. To exploit the none algorithm path, the attacker crafts a JWT with alg: none, an empty signature, and controlled claims, then presents it to a resource server that trusts tokens issued by the vulnerable provider. To exploit PKCE plain, the attacker intercepts the authorization code and the plaintext code_verifier on any intermediate channel, then redeems the code from an attacker-controlled client.
See the GitHub Security Advisory and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-67336
Indicators of Compromise
- Authorization server logs showing token issuance or acceptance with the JWT header alg: none.
- OAuth token exchange requests where code_challenge_method=plain appears in authorization requests.
- Successful token introspection responses for tokens that lack a valid signature segment.
- Unexpected redirect URIs or client identifiers completing PKCE flows initiated by legitimate users.
Detection Strategies
- Parse JWTs at ingress and reject any token where the header alg field equals none, then alert on the rejection.
- Inspect OAuth authorization endpoint traffic for code_challenge_method values other than S256.
- Audit installed better-auth package versions across build systems and running Node.js services.
- Correlate authentication events with source IP and user-agent to surface authorization code redemption from unexpected clients.
Monitoring Recommendations
- Track the version of better-auth reported by Software Bill of Materials (SBOM) tooling in continuous integration pipelines.
- Enable structured logging on the oidcProvider and mcp plugin endpoints for all algorithm and PKCE method fields.
- Forward OIDC token issuance and validation events to a centralized log platform for retrospective hunting once patched.
How to Mitigate CVE-2026-67336
Immediate Actions Required
- Upgrade better-auth to version 1.6.11 or later in all applications that load the oidcProvider or mcp plugins.
- Explicitly configure the allowed JWS algorithms and remove none from any custom algorithm list.
- Set the PKCE policy to require S256 and reject plain at the authorization endpoint.
- Rotate any signing keys and client secrets used by the vulnerable provider before restoring production traffic.
Patch Information
The maintainers released better-auth version 1.6.11 to remove the insecure defaults. The fix hardens the oidcProvider and mcp plugins to reject the none algorithm and require PKCE S256. Review the GitHub Security Advisory for the full change set and upgrade notes.
Workarounds
- Override the plugin configuration to enforce S256 as the only accepted PKCE method until the upgrade is applied.
- Restrict the advertised JWS algorithms to asymmetric options such as RS256 or ES256 and drop none from provider metadata.
- Terminate OIDC flows behind an authenticating gateway that validates JWT signatures independently of the upstream library.
# Upgrade better-auth to the patched release
npm install better-auth@1.6.11
# Verify installed version
npm ls better-auth
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
