CVE-2026-67335 better-auth CVE debrief

Who should care

Developers and administrators using better-auth versions before 1.6.2 should validate OAuth state parameter validation and consider implementing PKCE. This vulnerability affects those who use better-auth with cookie-backed state storage without PKCE, potentially allowing attackers to forge state parameters and create authenticated sessions or link accounts. Affected operators, platforms, and security teams should review the vulnerability and take necessary actions to mitigate the risk.

Technical summary

better-auth versions before 1.6.2 fail to validate OAuth state parameters against stored nonces when using cookie-backed state storage without PKCE, allowing attackers to forge state parameters and create authenticated sessions or link accounts. This vulnerability affects developers and administrators using better-auth versions before 1.6.2, who should validate OAuth state parameter validation and consider implementing PKCE. The vulnerability has a CVSS score of 6 and a severity of MEDIUM.

Defensive priority

Authenticated attackers may forge OAuth state parameters to create sessions or link accounts, indicating a need for validation checks.

Recommended defensive actions

• Verify OAuth state parameter validation in better-auth versions before 1.6.2
• Implement PKCE for enhanced security
• Monitor for suspicious authentication activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the better-auth vulnerability. Evidence is limited, requiring defensive verification. The vulnerability affects better-auth versions before 1.6.2, which fail to validate OAuth state parameters against stored nonces when using cookie-backed state storage without PKCE. This allows attackers to forge state parameters and create authenticated sessions or link accounts. Defenders should verify OAuth state parameter validation and consider implementing PKCE. Limited evidence is available, and further verification is necessary to determine the full scope of the vulnerability.

Official resources