CVE-2026-67332 in better-auth
Summary
by MITRE • 08/01/2026
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in @better-auth/oauth-provider versions prior to 1.7.0-beta.4 represents a critical authorization flaw that fundamentally undermines the security of the OAuth 2.0 framework implementation. This issue manifests as a failure to properly validate and enforce audience constraints during the token issuance process, creating a scenario where clients can obtain access tokens for resource servers they have never been authorized to access. The root cause lies in the omission of audience validation within the authorization grant processing pipeline, allowing malicious actors to manipulate the token creation flow without proper authorization boundaries.
The technical flaw operates at the core of OAuth 2.0 token validation mechanisms, specifically targeting the audience parameter handling during authorization grants. When a client requests an access token, the system should verify that the requested audience aligns with the scopes and permissions granted during the initial authorization process. However, in affected versions, this validation step is completely bypassed, enabling attackers to submit arbitrary audience values during token requests. This creates a situation where legitimate OAuth flows can be exploited to obtain tokens that target resources outside the originally intended scope of authorization, effectively breaking the principle of least privilege.
The operational impact of this vulnerability extends beyond simple unauthorized access, creating potential for significant data breaches and system compromise. Attackers can exploit this flaw to obtain access tokens that grant them privileges to access sensitive resource servers, databases, or APIs that were never part of their original authorization scope. This allows for lateral movement within systems and potentially full compromise of the affected OAuth provider infrastructure. The vulnerability is particularly dangerous because it operates silently without generating obvious error conditions, making detection difficult and allowing attackers to maintain persistent unauthorized access. According to CWE-284, this represents an improper access control issue where the system fails to properly enforce authorization boundaries, while the ATT&CK framework would categorize this under privilege escalation techniques that leverage authorization bypass mechanisms.
Mitigation strategies for this vulnerability require immediate implementation of audience validation checks within the OAuth provider's token issuance process. Organizations should upgrade to version 1.7.0-beta.4 or later where proper audience binding has been implemented. The fix must ensure that access tokens can only be issued with audiences that match those explicitly granted during the authorization process, preventing the injection of unauthorized resource server targets into token requests. Additionally, system administrators should implement comprehensive monitoring of token issuance patterns to detect anomalous audience requests that might indicate exploitation attempts. Regular security assessments of OAuth implementations should include validation of audience parameter handling and cross-checking of authorization boundaries to prevent similar issues in other components of the authentication infrastructure.