Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67335 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/better-auth/better-auth/security/advisories/GHSA-wxw3-q3m9-c3jr	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/better-auth-before-oauth-state-validation-bypass	[email protected]	AdvisoryVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	[email protected]

Affected Products

Product	Versions
better-auth	< 1.6.2 (semver)
CPE cpe:2.3:a:better-auth:better_auth::::::node.js::* Remediation Upgrade: 1.6.2moderate effort Workaround:low effort Switch `storeStateStrategy` back to "database" (the default). This closes the cookie-only bypass without a code change. Workaround:low effort Enable `pkce: true` on every affected `genericOAuth` provider. The `codeVerifier` is the missing primitive that the attacker cannot supply.

Product

Versions

better-auth

< 1.6.2 (semver)

CPE

cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*

Remediation

Upgrade: 1.6.2moderate effort
Workaround:low effort
Switch `storeStateStrategy` back to "database" (the default). This closes the cookie-only bypass without a code change.
Workaround:low effort
Enable `pkce: true` on every affected `genericOAuth` provider. The `codeVerifier` is the missing primitive that the attacker cannot supply.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 3, 2026	CVE Modified	CISA-ADP
Aug 1, 2026	New CVE Received	[email protected]