CVE-2026-67327 Details
Description
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
A vulnerability allowing account takeover has been identified in better-auth versions 1.1.3 prior to 1.6.22, as well as pre-release versions 1.7.0-beta.0 prior to 1.7.0-beta.10. This vulnerability arises when open email and password registration is enabled, allowing an attacker to register an account using a victim's email and a chosen password. The account remains unverified. When the victim later signs in using the magic-link or email-OTP passwordless flow, the account is marked as verified. However, the pre-existing password is not removed, nor are existing sessions revoked, allowing the attacker to maintain access to the victim's account.
Users can upgrade to better-auth version 1.6.22 or later on the stable line, or to version 1.7.0-beta.10 or later on the pre-release line. If an immediate upgrade is not possible, it is recommended to require email verification before accepting passwords and to promptly remove unverified accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 1, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/better-auth/better-auth/security/advisories/GHSA-qq9h-g4jm-xgf3 | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/better-auth-before-account-takeover-via-magic-link-email-otp | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth | >= 1.1.3, < 1.6.22 (semver) >= 1.7.0-beta.0, < 1.7.0-beta.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |