CVE-2026-67335
1 advisory.
npm/better-auth CVE-2026-67335: medium 5.3, EPSS 0.28%
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
Action: Upgrade better-auth to 1.6.2 or later.
npm i better-auth@1.6.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.2 | - |
Fixed versions
| 1.6.2 |
Sources
- osv: GHSA-wxw3-q3m9-c3jr
- https://github.com/better-auth/better-auth/security/advisories/GHSA-wxw3-q3m9-c3jr
- https://github.com/better-auth/better-auth/issues/8897
- https://github.com/better-auth/better-auth/pull/8949
- https://github.com/better-auth/better-auth/commit/9deb7936aba7931f2db4b460141f476508f11bfd
- https://github.com/better-auth/better-auth
CVE-2026-67335 · published · modified · JSON