EUVD-2026-51816
GHSA-mw34-3w2r-wp9p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but success depends on relying-party mis-negotiation or URL exposure (AC:H); impact crosses to relying-party systems (S:C) with high confidentiality/integrity and no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 26 npm packages depend on better-auth (19 direct, 7 indirect)
Ecosystem-wide dependent count for version 1.6.11.
DescriptionCVE.org
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
AnalysisAI
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider and mcp plugins, which advertise the 'none' signing algorithm in OIDC discovery and accept plain PKCE by default. Relying parties whose JWT libraries negotiate the algorithm from discovery metadata without pinning can be tricked into accepting unsigned ID tokens, while exposed authorization URLs allow interception of codes because plain PKCE offers no protection. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected component is Better Auth, a TypeScript/JavaScript authentication framework, specifically its OpenID Connect provider surface exposed via the oidcProvider() plugin and the mcp() plugin (which delegates to oidcProvider and inherits its defaults). The root cause maps to CWE-327 (use of a broken or risky cryptographic algorithm): the metadata builders unconditionally inject 'none' into id_token_signing_alg_values_supported (and resource_signing_alg_values_supported for mcp on the OAuth protected-resource metadata), signaling to relying parties that unsigned tokens are acceptable. Separately, the authorize handler silently rewrites a missing code_challenge_method to 'plain' before the allowlist check, so plain PKCE is accepted at runtime even though discovery advertises only S256 - a contradiction that violates RFC 9700 §2.1.1 (OAuth 2.1), which forbids plain. The canonical replacement package @better-auth/oauth-provider excludes 'none' from discovery and rejects 'plain' at parse time, and is not affected. Affected CPE: cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: better-auth 1.6.11 - upgrade to 1.6.11 or later, which removes 'none' from the advertised algorithm list and stops accepting plain PKCE. Where feasible, migrate off the deprecated oidcProvider and mcp plugins to the canonical @better-auth/oauth-provider package, whose discovery document excludes 'none' and whose authorize schema rejects 'plain' at parse time. If you cannot upgrade immediately, apply the workarounds in the GHSA advisory (https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4): concretely, ensure relying parties pin a specific signing algorithm (e.g. RS256) rather than negotiating from the discovery document so unsigned 'none' tokens are refused, and enforce S256-only PKCE by rejecting requests with code_challenge_method=plain or a missing method rather than downgrading to plain - the trade-off being that legacy clients that omit or send plain PKCE will break and must be updated. Also treat authorization URLs as sensitive and avoid logging or exposing them beyond the user agent and OP to blunt code interception.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days afte
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today