---
id: CVE-2026-67336
title: >-
  better-auth versions before 1.6.11 contain insecure cryptographic defaults in
  the oidcProvider and mcp plugins that advertise the none algorithm and accept
  plain PKCE by default
summary: >-
  better-auth versions before 1.6.11 contain insecure cryptographic defaults in
  the oidcProvider and mcp plugins that advertise the none algorithm and accept
  plain PKCE by default. Attackers can exploit algorithm negotiation to accept
  unsi…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-327
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:34:34.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67336'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00236
epssPercentile: 0.13067
ingestedAt: '2026-08-02T09:18:11.415Z'
---

## Overview

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.