Is CVE-2026-67335 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67335 being exploited in the wild.

How severe is CVE-2026-67335?

Medium severity, with a CVSS score of 5.3, published 1 August 2026.

Which products and versions are affected?

better-auth (npm) SEMVER:introduced=0,fixed=1.6.2.

Is there a fix for CVE-2026-67335?

Yes. better-auth (npm): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67335 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67335?

Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67335: Better Auth OAuth state validation bypass in cookie-backed storage

CVE-2026-67335 · Severity: medium · CVSS 5.3 · Published 2026-08-01

Better Auth is an authentication library used by web applications to integrate OAuth login flows. When configured to store OAuth session state in cookies (instead of the default database) and without additional PKCE security, the library fails to properly validate the OAuth state parameter, allowing attackers to trick users into logging in or linking accounts under attacker-controlled identities. This could enable account takeover or persistent unauthorized access.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-67335 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67335 being exploited in the wild.
How severe is CVE-2026-67335?: Medium severity, with a CVSS score of 5.3, published 1 August 2026.
Which products and versions are affected?: better-auth (npm) SEMVER:introduced=0,fixed=1.6.2.
Is there a fix for CVE-2026-67335?: Yes. better-auth (npm): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67335 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67335?: Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.6.2 or later
```
npm install better-auth@1.6.2
```

Technical details

The vulnerability exists in the parseGenericState function's cookie-backed code path, which decrypts and validates the OAuth state cookie expiry but fails to compare the incoming OAuth state query parameter against the nonce stored in the encrypted payload. When PKCE is disabled (pkce: false) or custom token endpoints bypass code-verifier enforcement, an attacker can force a victim's browser to the OAuth callback endpoint with a forged state parameter and attacker-controlled authorization code. Since the cookie validation only checks expiry without verifying state equality, the callback accepts the forged request and mints a session bound to the attacker's external identity. The database-backed strategy (default) is not affected because state verification is enforced by keying the lookup to the state value. The patch (v1.6.2) adds explicit state equality validation in the encrypted cookie payload and applies defense-in-depth checks to all callers including generic OAuth, social login, account-linking, OIDC SSO, and SAML flows.

Affected products

Better Auth better-auth <1.6.2

Identifiers

CVE-2026-67335
GHSA-wxw3-q3m9-c3jr

Timeline

2026-05-15: disclosed: Published as GHSA-wxw3-q3m9-c3jr with CVE-2026-67335
2026-04-09: patched: Fixed in v1.6.2 (commit 9deb7936a via PR #8949)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.