CVE-2026-67327 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-67327

CVSS 8.3 · High EPSS 0,43%

Kerentanan Improper Authentication. Skor CVSS 3.1 8.3 (High) menurut vulncheck.com.

Deskripsi (NVD)

better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an attacker-chosen password; the account remains unverified. When the legitimate owner later signs in via the magic-link or email-OTP passwordless flow, the account is marked verified without removing the pre-existing password or revoking existing sessions, so the attacker's password remains valid, granting persistent access to the victim's account. Fixed in 1.6.22 and 1.7.0-beta.10.

Rincian

Terbit di NVD: 1 Agustus 2026
Terakhir diubah: 8 September 2026
Status NVD: Deferred
CVSS 3.1: 8.3 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.