CVE-2026-67335: fallo de gravedad media en better-auth
better-auth before 1.6.2 OAuth State Validation Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 0.3%
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
better-auth · better-authCVEs relacionadas — better-auth
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-61928CRITICALBetter Auth: Unauthenticated API key creation through api-key pluginEPSS 19.7%CVE-2025-71404MEDIUMbetter-auth before 1.1.16 Reflected XSS via error parameterEPSS 0.7%CVE-2025-71399HIGHBetter Auth before 1.4.5 Path Normalization Bypass via rou3EPSS 0.5%CVE-2026-67337HIGHbetter-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCacheEPSS 0.5%CVE-2025-71401CRITICALbetter-auth before 1.4.2 basePath Modification DoSEPSS 0.5%CVE-2026-67327HIGHbetter-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPEPSS 0.4%