CyberRota Analysis
AI-GeneratedVersions of better-auth prior to 1.6.11 are vulnerable due to insecure cryptographic defaults in the oidcProvider and mcp plugins, which allow the use of the "none" algorithm and accept plain PKCE by default. This vulnerability can be exploited by attackers to accept unsigned tokens or intercept authorization codes, potentially compromising user authentication. Organizations using affected versions should prioritize remediation to safeguard against unauthorized access and token interception.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.