CVE-2026-67335 in better-auth
Summary
by MITRE • 08/01/2026
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in better-auth versions prior to 1.6.2 represents a critical authentication bypass flaw that undermines the core security mechanisms of OAuth 2.0 implementations. This weakness specifically targets the state parameter validation process within the OAuth flow, which serves as a crucial anti-forgery mechanism designed to prevent cross-site request forgery attacks. The vulnerability manifests when cookie-backed state storage is employed without implementing Proof Key for Code Exchange (PKCE) extensions, creating an exploitable gap in the authentication workflow.
The technical flaw stems from the improper validation of OAuth state parameters against stored nonces during the authorization process. In proper OAuth implementations, the state parameter should be cryptographically bound to the session and validated against a stored value before proceeding with token exchange. When this validation is omitted or incorrectly implemented, attackers can manipulate the state parameter to their advantage. The vulnerability becomes particularly dangerous when combined with cookie-based storage mechanisms, as the attacker can leverage predictable or guessable state values to create fraudulent authentication flows.
The operational impact of this vulnerability extends beyond simple session hijacking to encompass account takeover scenarios and persistent identity linking attacks. Attackers can craft malicious state parameters that appear legitimate to the authentication server while simultaneously supplying attacker-controlled authorization codes. This creates authenticated sessions where victims are bound to attacker-controlled external identities, effectively allowing unauthorized access to victim accounts. The persistence of these attacks means that successful exploitation can result in long-term unauthorized access rather than just temporary session compromise.
This vulnerability aligns with CWE-384, which addresses the improper use of state parameters in web applications, and maps to ATT&CK technique T1566.001 for credential access through social engineering. The flaw represents a failure in implementing proper session management controls and demonstrates inadequate input validation mechanisms. Organizations using affected versions of better-auth face significant risk of unauthorized account access, data breaches, and potential lateral movement within their systems.
The recommended mitigation strategy involves upgrading to better-auth version 1.6.2 or later, which implements proper state parameter validation against stored nonces. Additionally, organizations should ensure that PKCE is enabled for all OAuth flows, implement strict cookie security policies including HttpOnly and Secure flags, and establish robust session management controls. Regular security audits of authentication flows should be conducted to identify similar validation gaps in other components, while monitoring systems should be configured to detect anomalous authentication patterns that might indicate exploitation attempts.