Is CVE-2026-67327 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67327 being exploited in the wild.

How severe is CVE-2026-67327?

High severity, with a CVSS score of 8.3, published 1 August 2026.

Which products and versions are affected?

better-auth (npm) SEMVER:introduced=1.1.3,fixed=1.6.22.

Is there a fix for CVE-2026-67327?

Yes. better-auth (npm): upgrade to 1.6.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67327 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67327?

Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67327: Better Auth account takeover via pre-account hijacking in magic-link and email-OTP

CVE-2026-67327 · Severity: high · CVSS 8.3 · Published 2026-08-01

Better Auth is an authentication library used by applications to manage user sign-up and login flows. In configurations that support both passwordless login (magic-link or email-OTP) and traditional email/password registration, an attacker can pre-register an account using a victim's email address. When the victim later signs in via the passwordless flow, their action inadvertently unlocks the attacker's pre-planted password, allowing the attacker to maintain account access alongside the legitimate owner. This enables data theft, unauthorized modifications, and account lockout.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-67327 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67327 being exploited in the wild.
How severe is CVE-2026-67327?: High severity, with a CVSS score of 8.3, published 1 August 2026.
Which products and versions are affected?: better-auth (npm) SEMVER:introduced=1.1.3,fixed=1.6.22.
Is there a fix for CVE-2026-67327?: Yes. better-auth (npm): upgrade to 1.6.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67327 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67327?: Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.6.22 or later
```
npm install better-auth@1.6.22
```

Technical details

This is a pre-account hijacking vulnerability affecting magic-link and email-OTP authentication flows in Better Auth. The root cause is insufficient credential revocation: when passwordless login confirms email ownership on an account that was never email-verified, the library fails to remove unverified passwords and revoke prior sessions set during the unverified state. An attacker exploits this by registering with open registration using the victim's email and a chosen password, leaving the account unverified. When the legitimate user proves email ownership via magic-link or email-OTP, the account becomes verified and the attacker's password remains active. The attack requires user interaction (victim signing in via passwordless flow) but no privileges, spreads over the network, and affects only systems with both features enabled and open email/password registration. Fixed versions remove unproven credentials and revoke sessions before marking the account verified.

Affected products

Better Auth Better Auth 1.1.3 to 1.6.21; 1.7.0-beta.0 to 1.7.0-beta.9

Identifiers

CVE-2026-67327
GHSA-qq9h-g4jm-xgf3

Timeline

2026-07-24: disclosed
2026-07-24: patched: Patches released: 1.6.22 and 1.7.0-beta.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.