CVE-2026-67335: better-auth before 1.6.2 OAuth State Validation Bypass
Published Aug 1, 2026
·Updated
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
Affected Software
1 affected component
npm/better-auth<1.6.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.6.2Patch better-auth before 1.6.2 OAuth State Validation Bypass
Event History
Aug 1, 2026
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness