{"action":"Upgrade @better-auth/oauth-provider to 1.7.0-beta.4 or later.","affected":[{"fixed":"1.7.0-beta.4","introduced":"1.4.8"}],"component":"@better-auth/oauth-provider","cve_ids":["CVE-2026-67332"],"ecosystem":"npm","epss":0.0026,"exploited":false,"fixed_versions":["1.7.0-beta.4"],"ghsa_id":"GHSA-p2fr-6hmx-4528","id":"tcs_01M5KG27BFSGE7ZFKV60BW9QE6","modified_at":"2026-09-10T03:50:12.269109487Z","published_at":"2026-07-07T20:54:32Z","references":["https://osv.dev/vulnerability/GHSA-p2fr-6hmx-4528","https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528","https://github.com/better-auth/better-auth","https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.4"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-p2fr-6hmx-4528","url":"https://osv.dev/vulnerability/GHSA-p2fr-6hmx-4528"}],"summary":"@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators"}