Executive brief
Better Auth, a library used for managing user authentication, contains insecure default settings in its OIDC and MCP plugins. These flaws could allow attackers to bypass security checks, potentially leading to unauthorized access to user accounts or the interception of sensitive login codes. Organizations using these plugins should update to the latest version or migrate to the recommended replacement to ensure their authentication systems remain secure.
Technical details
The legacy oidcProvider and mcp plugins in Better Auth exhibit two cryptographic weaknesses. First, the OIDC discovery document unconditionally advertises 'none' in the supported signing algorithms, which can lead to algorithm-negotiation downgrades where relying parties accept unsigned JWTs. Second, the plugins default to accepting the 'plain' PKCE code challenge method and silently downgrade missing methods to 'plain', violating RFC 9700 (OAuth 2.1) standards and failing to protect authorization codes from interception if URLs are leaked. The vulnerability is fixed in version 1.6.11 by removing 'none' from discovery and defaulting allowPlainCodeChallengeMethod to false. Security engineers are encouraged to migrate to the @better-auth/oauth-provider package, which is structurally unaffected.
Affected products
- better-auth better-auth < 1.6.11
Timeline
- 2026-05-31: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-07: advisory: Advisory updated and reviewed
- 2026-07-07: patched: Fixed in version 1.6.11