---
id: CVE-2026-67332
title: >-
  @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token
  audience to the authorization grant, allowing clients to request tokens for
  unrelated resources
summary: >-
  @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token
  audience to the authorization grant, allowing clients to request tokens for
  unrelated resources. Attackers can complete an OAuth flow and obtain access
  tokens who…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-285
vendor: better-auth
product: oauth-provider
affected:
  - oauth-provider >= 1.4.8 < 1.7.0-beta.4
published: '2026-08-01'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:31.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67332'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-03T18:31:41.763951Z'
epss: 0.0026
epssPercentile: 0.17585
ingestedAt: '2026-08-02T08:18:07.450Z'
---

## Overview

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.