PT-2026-67315 · Unknown · Better Auth
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
better-auth versions prior to 1.6.2
Description
An issue exists where the software fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE (Proof Key for Code Exchange). In the
parseGenericState function, the cookie branch decrypted the oauth state cookie and validated expiry but did not compare the incoming OAuth state query parameter to the nonce issued at sign-in. This allows attackers to forge the state parameter and provide an attacker-controlled authorization code to the /api/auth/oauth2/callback/<providerId> endpoint. This can lead to forced-login (CSRF on OAuth callback), where a victim's browser is placed into a session bound to the attacker's external identity, or persistent account linking, where an attacker's external account is bound to the victim's authenticated profile.Recommendations
Upgrade to version 1.6.2 or later.
Switch
storeStateStrategy to database.
Enable pkce: true on every affected genericOAuth provider.Exploit
Fix
CSRF
Improper Authentication
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Better Auth