CVE-2026-67335: better-auth before 1.6.2 OAuth State Validation Bypass
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.6.2Patch better-auth before 1.6.2 OAuth State Validation Bypass
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67335?
CVE-2026-67335 has a medium severity rating of 6.
How do I fix CVE-2026-67335?
To fix CVE-2026-67335, update to better-auth version 1.6.2 or later.
What issue does CVE-2026-67335 present?
CVE-2026-67335 allows attackers to bypass OAuth state validation, potentially leading to unauthorized session creation.
What versions of better-auth are vulnerable to CVE-2026-67335?
All versions of better-auth prior to 1.6.2 are vulnerable to CVE-2026-67335.
What is the impact of CVE-2026-67335?
CVE-2026-67335 can result in an attacker gaining authenticated access by exploiting the OAuth state validation bypass.