AIKIDO-2026-204536
better-auth is vulnerable to Insecure Cryptographic Defaults
78
High Risk
This Affects:
better-authTL;DR
The legacy oidcProvider and mcp plugins advertise "none" in id_token_signing_alg_values_supported (and resource_signing_alg_values_supported for mcp) and accept PKCE code_challenge_method=plain by default, including silently rewriting a missing method to plain before the allowlist check. Relying parties that negotiate algorithms from discovery without pinning may accept unsigned tokens, and authorization-code interception becomes easier when the authorize URL leaks because plain PKCE provides no real challenge binding. The fix drops "none" from discovery metadata, defaults allowPlainCodeChallengeMethod to false, and rejects a code_challenge without an explicit code_challenge_method.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application enables the legacy oidcProvider or mcp plugins from better-auth.
Background info
better-auth is vulnerable to Insecure Cryptographic Defaults in versions 0.0.1 - 1.6.10.
How to fix this
Upgrade the better-auth library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant