A vulnerability in the better-auth library allows for the use of broken cryptographic algorithms, potentially enabling unauthorized access to protected information.

This vulnerability is categorized as CWE-327, involving the use of a broken or risky cryptographic algorithm. It is an unauthenticated vulnerability that may result in the compromise of sensitive data.

The use of weak cryptographic standards undermines the integrity and confidentiality of the authentication process. A successful exploit could lead to data compromise, potentially allowing an attacker to intercept or manipulate sensitive identity tokens, which poses a significant risk to organizational security and compliance. Given the CVSS score of 8.7, this is classified as a high-severity issue requiring immediate attention.

Immediate Action: Update the better-auth npm package to version 1.6.11 or later to implement secure cryptographic defaults.

Proactive Monitoring: Review authentication logs for anomalous token generation or validation errors that may indicate exploitation attempts.

Compensating Controls: Ensure that OIDC traffic is inspected by robust network security controls and that all downstream services validate identity tokens strictly.

Public Exploit Available: No

The severity of this vulnerability necessitates a prompt update to the patched version. Administrators should prioritize the deployment of version 1.6.11 across all development and production environments to remediate the underlying cryptographic weakness.