Insecure cryptographic defaults in better-auth oidcProvider and mcp plugins (CVE-2026-67336)

The legacy oidcProvider and mcp plugins in better-auth advertise the "none" algorithm in OIDC discovery metadata and accept PKCE plain method by default, contradicting RFC 9700 requirements. Relying parties performing algorithm negotiation without pinning may accept unsigned tokens, and authorization codes may be intercepted when plain PKCE is used instead of the required S256 method. Affected versions: - < 1.6.11 We recommend updating to: 1.6.11. CVSS 9.4 · our assessment: act_now Reference: https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4 Details: https://vuln.today/cve/CVE-2026-67336