CVE-2026-67335 — better-auth before 1.6.2 OAuth State Validation Bypass
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge th…
Published: 2026-08-01 · CVSS: 6.0 · CVSS 4.0
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7