CVE-2026-67327 better-auth CVE debrief

Who should care

Organizations using better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled should be aware of the vulnerability and take steps to mitigate it.

Technical summary

The better-auth library versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker can register an account with the victim's email address and an attacker-chosen password, which remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, granting persistent access to the victim's account.

Defensive priority

Organizations using better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled should prioritize upgrading to 1.6.22 or 1.7.0-beta.10 to mitigate account takeover via pre-account hijacking on magic-link and email-OTP sign-in.

Recommended defensive actions

• Upgrade to better-auth version 1.6.22 or 1.7.0-beta.10
• Disable open email/password registration if not required
• Monitor for suspicious account activity
• Implement additional authentication factors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker can register an account with the victim's email address and an attacker-chosen password, which remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, granting persistent access to the victim's account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.