Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-01 | 2 | Disclosure2 |
| 2026-08-03 | 2 | General1Patch1 |
| 2026-10-21 | 1 | Patch1 |
If your auth stack uses better-auth < 1.6.11, you're shipping two critical vulns by default. CVE-2026-67336, CVSS 8.7. Here's what breaks and how to fix it Monday.
Post summary
A warning that the better-auth library <1.6.11 contains a critical CVE-2026-67336 (CVSS 8.7), with a fix expected next Monday.
CVE-2026-67336: better-auth before 1.6.11 accepts unsigned JWTs and plain PKCE in its OIDC and MCP plugins. Check your verifier has an explicit alg allowlist and your PKCE path demands S256. https://offensive360.com/zerodays/cve-2026-67336-better-auth/?utm_medium=social&utm_campaign=vuln_research&utm_source=x&utm_content=20261021 #CVE #AppSec https://t.co/kGAjA5ASwX
Post summary
The tweet announces CVE-2026-67336 affecting better-auth versions before 1.6.11, detailing the vulnerability (unsigned JWTs and plain PKCE in OIDC/MCP plugins) and providing both a fixed version and specific mitigation workarounds.
Insecure defaults kill platforms. If your auth library ships with 'none' algorithm support, you're one negotiation away from unsigned everything. source: https://nvd.nist.gov/vuln/detail/CVE-2026-67336
Post summary
The message notes that CVE‑2026‑67336 allows attack via insecure default support of the "none" algorithm, but provides no further technical or actionable details.
🚨*CVE* CVE-2026-67336 better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE… https://www.cve.org/CVERecord?id=CVE-2026-67336 ----- Traducción: CVE-2026-67336 las… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑67336, outlining insecure crypto defaults in certain plugins, but provides no PoC, exploit code, or patch details.
CVE-2026-67336 better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE… https://www.cve.org/CVERecord?id=CVE-2026-67336
Post summary
The announcement highlights insecure cryptographic defaults in better-auth prior to 1.6.11—advertising the 'none' algorithm and accepting plain PKCE—but provides no PoC, exploit, or mitigation information.