CVE-2026-67327 better-auth CVE debrief

Who should care

Organizations using better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled should be aware of the vulnerability and take steps to mitigate it.

Technical summary

The better-auth library versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker can register an account with the victim's email address and an attacker-chosen password, which remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, granting persistent access to the victim's account.

Defensive priority

Organizations using better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) with open email/password registration enabled should prioritize upgrading to 1.6.22 or 1.7.0-beta.10 to mitigate account takeover via pre-account hijacking on magic-link and email-OTP sign-in.

Recommended defensive actions

• Upgrade to better-auth version 1.6.22 or 1.7.0-beta.10
• Disable open email/password registration if not required
• Monitor for suspicious account activity
• Implement additional authentication factors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker can register an account with the victim's email address and an attacker-chosen password, which remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, granting persistent access to the victim's account.

Official resources