better-auth >=1.1.3/prior 1.7.0-beta.9 improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in better-auth >=1.1.3/prior 1.7.0-beta.9. This affects an unknown part. Executing a manipulation can lead to improper authentication. This vulnerability appears as CVE-2026-67327. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in better-auth >=1.1.3/prior 1.7.0-beta.9. It has been declared as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-67327 since 07/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.6.22 or 1.7.0-beta.10 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• better-auth

Version

• <1.7.0-beta.9
• >=1.1.3

Website

• Product: https://github.com/better-auth/better-auth/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion