Is CVE-2026-67332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67332 being exploited in the wild.

How severe is CVE-2026-67332?

Medium severity, with a CVSS score of 6.4, published 1 August 2026.

Which products and versions are affected?

Better-Auth Oauth-Provider >=1.4.8, <1.7.0-beta.4; @better-auth/oauth-provider (npm) SEMVER:introduced=1.4.8,fixed=1.7.0-beta.4.

Is there a fix for CVE-2026-67332?

Yes. @better-auth/oauth-provider (npm): upgrade to 1.7.0-beta.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67332 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67332?

Check whether you run Better-Auth Oauth-Provider or @better-auth/oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67332: better-auth oauth-provider access token audience not bound to authorization grant

Q: Is there a fix for CVE-2026-67332?

Yes. @better-auth/oauth-provider (npm): upgrade to 1.7.0-beta.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67332 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-67332?

Check whether you run Better-Auth Oauth-Provider or @better-auth/oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67332 · Severity: medium · CVSS 6.4 · Published 2026-08-01

@better-auth/oauth-provider is a library that handles OAuth 2.0 authentication and token management. The vulnerability allows an attacker who completes an OAuth authorization flow to request access tokens for resource servers that were never authorized by the user. If resource servers rely on token audience claims for access control, an attacker could access protected resources beyond the original authorization scope.

Technologies: Better-Auth Oauth-Provider, @better-auth/oauth-provider (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-67332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67332 being exploited in the wild.
How severe is CVE-2026-67332?: Medium severity, with a CVSS score of 6.4, published 1 August 2026.
Which products and versions are affected?: Better-Auth Oauth-Provider >=1.4.8, <1.7.0-beta.4; @better-auth/oauth-provider (npm) SEMVER:introduced=1.4.8,fixed=1.7.0-beta.4.
Is there a fix for CVE-2026-67332?: Yes. @better-auth/oauth-provider (npm): upgrade to 1.7.0-beta.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67332 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67332?: Check whether you run Better-Auth Oauth-Provider or @better-auth/oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@better-auth/oauth-provider (npm): upgrade to 1.7.0-beta.4 or later
```
npm install @better-auth/oauth-provider@1.7.0-beta.4
```

Technical details

The vulnerability is an authorization bypass (CWE-863) in the resource parameter handling (RFC 8707). The oauth-provider accepts resource indicators only at the token endpoint and fails to bind them to the authorization grant. An attacker can complete a normal OAuth authorization flow, then request a JWT access token with an audience (aud claim) targeting any resource in the server's validAudiences allowlist, even if that resource was never approved by the user. The same issue affects refresh tokens: a refresh token from one resource grant can be redeemed for tokens targeting different resources. No user interaction is required beyond completing the initial authorization. The vulnerability is fixed in version 1.7.0-beta.4 and later, but the stable 1.6.x line remains unpatched. The fix is breaking and requires schema migration.

Affected products

better-auth oauth-provider >=1.4.8, <1.7.0-beta.4

Identifiers

CVE-2026-67332
GHSA-p2fr-6hmx-4528

Timeline

2026-05-31: disclosed
2026-07-07: published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.