CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
Attackers can hijack accounts by pre-registering with victim emails when open registration is enabled, retaining access after victim verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-67327?
CVE-2026-67327 is a high-severity authentication bypass vulnerability in better-auth, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.
Weakness: CWE-287
Which versions are affected by CVE-2026-67327?
4 open source packages ship an affected version, including better-auth.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | From 1.1.3 | 1.6.22 |
better-auth npm | From 1.1.3 | 1.6.22 |
better-auth npm | From 1.7.0-beta.0 | 1.7.0-beta.10 |
better-auth npm | From 1.7.0-beta.0 | 1.7.0-beta.10 |
How do I fix CVE-2026-67327?
Upgrade better-auth to a fixed version for your release line: 1.6.22 or 1.7.0-beta.10.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-67327 being exploited?
There is no known exploitation of CVE-2026-67327 in the wild and no public exploit code.
Sources
Also known as GHSA-9wm3-rh5c-fc37, GHSA-qq9h-g4jm-xgf3.