Better Auth: 17 Vulnerabilities Disclosed Together, Including Critical Authorization Bypass Flaws
Key findings • 17 vulnerabilities disclosed for Better Auth between August 1-2, 2026, ranging from Low to Critical severity. • Key themes include authorization bypass, insecure direct object …
Key findings
- 17 vulnerabilities disclosed for Better Auth between August 1-2, 2026, ranging from Low to Critical severity.
- Key themes include authorization bypass, insecure direct object references, and insecure cryptographic defaults across multiple plugins.
- Critical CVE-2026-67330 involves an SCIM authorization bypass, potentially leading to account takeovers.
- High severity CVE-2026-67328 details multiple SSO authentication bypass vulnerabilities.
- Patches are available in versions 1.4.x, 1.6.x, and 1.7.0-beta.x; users urged to update immediately.
On August 1st and 2nd, 2026, a significant batch of 17 vulnerabilities was disclosed for Better Auth, a popular authentication and authorization solution. These vulnerabilities, spanning a range of severities from Low to Critical, were disclosed within a 24-hour window, highlighting a widespread security concern for users of the Better Auth product. The disclosures include issues across various components and plugins, such as SCIM, OAuth, SSO, and core authentication flows, indicating a broad impact on the product's security posture.
Several vulnerabilities revolve around authorization bypass and insecure direct object references, allowing attackers to gain unauthorized access or manipulate resources. For instance, CVE-2025-71400 (High) details an insecure direct object reference in the passkey deletion endpoint, enabling authenticated users to delete arbitrary passkeys. Similarly, CVE-2026-67330 (Critical) describes an authorization bypass in the SCIM plugin where token issuance did not properly reject provider IDs already in use by other authentication methods, potentially leading to account takeovers. CVE-2026-67329 (High) also points to an authorization bypass in organization subscription actions within the Stripe plugin.
Another theme emerging from this batch is the insecure handling of cryptographic defaults and authentication mechanisms. CVE-2026-67336 (High) highlights insecure cryptographic defaults in the oidcProvider and mcp plugins, allowing the 'none' algorithm and plain PKCE, which can be exploited to accept unsigned tokens or intercept authorization codes. CVE-2026-67333 (High) addresses an issue where redirect_uris registered via the oidc-provider and mcp plugins were not properly validated, allowing attackers to register malicious javascript: URIs. Furthermore, CVE-2026-67328 (High) details multiple authentication bypass vulnerabilities in SSO provider handling, enabling attackers to sign in as arbitrary users through various means like domain verification parsing mismatches and unbound SAML assertions.
The batch also includes vulnerabilities related to session management and data handling. CVE-2026-67334 (Low) describes a failure to delete cached sessions when users are removed, potentially allowing attackers to reuse deleted session tokens for up to seven days. CVE-2025-71401 (Medium) involves an external request configuration vulnerability in the npm package that could lead to a denial of service by poisoning the router's base path. Additionally, CVE-2025-71404 (Medium) is a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the 'error' URL parameter is reflected without proper neutralization.
Several critical and high-severity issues were patched in versions 1.4.x, 1.6.x, and 1.7.0-beta.x of Better Auth. Specifically, CVE-2026-67330 (Critical) and CVE-2026-67328 (High) were fixed in versions before 1.6.21 and 1.7.0-beta.10 respectively. CVE-2026-67336 (High) was addressed in versions before 1.6.11. Users are strongly advised to update to the latest available versions to mitigate these risks. The wide range of vulnerabilities and their high severity underscores the importance of prompt patching for all Better Auth users to maintain the security and integrity of their authentication systems.
The disclosure of these 17 vulnerabilities within a short timeframe indicates a concerted effort to address significant security weaknesses in Better Auth. The variety of issues, from authorization bypasses to cryptographic flaws and XSS, suggests a need for a thorough review of the product's security architecture. Users should prioritize updating their Better Auth instances to the patched versions to protect against potential exploitation. The vendor's rapid patching across multiple plugins and versions demonstrates a commitment to addressing these issues, but the sheer number of disclosed vulnerabilities warrants careful attention from the user community.