What’s Vulnerable › Vulnerabilities

CVE-2026-67332: @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-01 · updated 2026-10-23
• Weakness: CWE-285

Description

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.

Affected products

• better-auth oauth-provider: from 1.4.8 before 1.7.0-beta.4 — fixed in 1.7.0-beta.4

How to fix

Upgrade to a fixed version: better-auth oauth-provider 1.7.0-beta.4. Check the vendor advisory for mitigations.

References

• https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
• https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass

Get alerted when CVE-2026-67332 or the next vulnerability affects your stack