What is GHSA-mw34-3w2r-wp9p?

GHSA-mw34-3w2r-wp9p is a security advisory published by GitHub Security Advisories with Critical severity. better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider...

Which CVE IDs does GHSA-mw34-3w2r-wp9p cover?

GHSA-mw34-3w2r-wp9p covers the following CVE IDs: CVE-2026-67336. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mw34-3w2r-wp9p?

GHSA-mw34-3w2r-wp9p has a CVSS v3 base score of 8.7, published by GitHub Security Advisories.

GHSA-mw34-3w2r-wp9pCriticalCVSS 8.7

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-67336 →

📋 Description

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

🔗 References (4)

https://github.com/better-auth/better-auth/security/advisories/GHSA-9h47-pqcx-hjr4
https://nvd.nist.gov/vuln/detail/CVE-2026-67336
https://www.vulncheck.com/advisories/better-auth-before-insecure-cryptographic-defaults-via-oidcprovider
https://github.com/advisories/GHSA-mw34-3w2r-wp9p