CVE-2026-67332
1 advisory.
npm/@better-auth/oauth-provider CVE-2026-67332: medium 6.4
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Action: Upgrade @better-auth/oauth-provider to 1.7.0-beta.4 or later.
npm i @better-auth/oauth-provider@1.7.0-beta.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.8 | 1.7.0-beta.4 | - |
Fixed versions
| 1.7.0-beta.4 |
Sources
- osv: GHSA-p2fr-6hmx-4528
- https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.4
CVE-2026-67332 · published · modified · JSON