CVE-2026-67327 in better-auth
Summary
by MITRE • 08/01/2026
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability affects better-auth versions between 1.1.3 and 1.7.0-beta.10 where the authentication system fails to properly handle account verification during passwordless sign-in flows. The flaw stems from inadequate session management and credential validation mechanisms that allow attackers to hijack accounts through a sophisticated pre-account takeover technique. When open email/password registration is enabled, attackers can exploit this weakness by creating accounts using victim email addresses with their own chosen passwords while leaving these accounts unverified. This creates a dangerous scenario where the attacker maintains valid credentials for the victim's email address even after the legitimate user attempts to authenticate through passwordless methods.
The technical implementation of this vulnerability involves multiple layers of authentication failure that align with CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). The system's failure to properly validate account ownership during passwordless sign-in flows creates a race condition where the legitimate user's authentication attempt inadvertently verifies an attacker-controlled account instead of creating a new one. This represents a critical breakdown in the authentication flow as defined by the authentication framework standards, where the system should ensure that only valid account holders can establish authenticated sessions.
The operational impact of this vulnerability is severe and persistent, granting attackers continuous access to victim accounts without requiring additional compromise methods. The attacker's chosen password remains valid even after the legitimate user successfully authenticates through magic-link or email-otp flows, creating a backdoor access vector that can persist across multiple session renewals and device changes. This type of attack pattern aligns with ATT&CK technique T1566 (Phishing) and T1078 (Valid Accounts) where attackers leverage legitimate authentication mechanisms to gain unauthorized access. The vulnerability allows for account takeover without detection since the system treats the attacker's pre-existing credentials as valid, creating a stealthy persistent threat that can remain undetected for extended periods.
The mitigation strategy requires careful implementation of proper session management and credential validation during account verification processes. System administrators should implement immediate updates to versions 1.6.22 or 1.7.0-beta.10 where the vulnerability has been patched, ensuring that pre-existing passwords are properly cleared when accounts are verified through passwordless flows. The fix addresses the core issue by implementing proper credential lifecycle management that revokes existing sessions and clears attacker-chosen passwords upon successful account verification. Organizations should also consider implementing additional security controls such as email domain validation, rate limiting for authentication attempts, and monitoring for suspicious account creation patterns. The resolution demonstrates proper implementation of authentication best practices as outlined in NIST SP 800-63B guidelines, specifically addressing the need for robust account verification mechanisms that prevent credential confusion during authentication flows.