What happened
Published August 1, 2026 (CVSS 8.7/High). better-auth's MCP authentication plugin (built on its OIDC provider) shipped with insecure defaults permitting algorithm-confusion (accepting `alg: none`) and weak PKCE, undermining the authorization layer meant to protect MCP tool/resource access.
Why it matters
better-auth's mcp plugin is used to gate access to Model Context Protocol servers/tools; insecure crypto defaults mean an attacker could forge authentication tokens or hijack the OAuth authorization-code flow to gain unauthorized access to MCP-connected AI agent tooling and any downstream systems those tools can act on.
Attack vector
The oidcProvider and mcp plugins advertise support for the `none` JWT signing algorithm and accept PKCE `plain` method by default. An attacker can exploit algorithm negotiation to have unsigned (forged) tokens accepted, or intercept authorization codes when PKCE plain is negotiated, bypassing authentication for MCP-protected resources.
Affected systems
better-auth < 1.6.11 (oidcProvider and mcp plugins)
Mitigation
Upgrade better-auth to 1.6.11 or later; explicitly disable `none` algorithm support and enforce PKCE S256 in OIDC/MCP configuration. See GHSA-9h47-pqcx-hjr4.