---
id: CVE-2026-67332
title: >-
  @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token
  audience to the authorization grant, allowing clients to request tokens for
  unrelated resources
summary: >-
  @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token
  audience to the authorization grant, allowing clients to request tokens for
  unrelated resources. Attackers can complete an OAuth flow and obtain access
  tokens who…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-285
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:34:34.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67332'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0026
epssPercentile: 0.15702
ingestedAt: '2026-08-02T08:18:07.450Z'
---

## Overview

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.