{"uuid": "3a8acded-8c02-417e-8278-462aa2cd8a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67336", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117022971447141232", "content": "CVE-2026-67336: better-auth <1.6.11 uses insecure crypto defaults in oidcProvider & mcp, advertising 'none' algo & accepting plain PKCE. Exploitation can lead to unsigned tokens & code interception. Severity: CRITICAL. Patch to 1.6.11+ https://radar.offseq.com/threat/better-auth-versions-before-1611-contain-insecure-cryptographic-defaults-in-the-oidcprovider-and-mcp-eb22076a221f3a81 #OffSeq #CVE202667336 #OAuth #Security", "creation_timestamp": "2026-08-02T00:00:37.529213Z"}