Summary
Insecure cryptographic defaults in better-auth's oidcProvider and mcp plugins advertise the "none" algorithm and accept plain PKCE, weakening token and authorization code protection.
Under misconfigured or downgraded clients, attackers could negotiate unsigned tokens or intercept authorization codes when PKCE is not enforced with the S256 method.
Affected context
The issue arises in applications integrating better-auth (versions before 1.6.11) for OpenID Connect or related flows using the oidcProvider and mcp plugins.
It is most relevant when relying parties accept provider-advertised algorithms and PKCE methods without additional policy enforcement.
Environments that allow legacy or loosely-configured OAuth/OIDC clients, or that do not require S256-based PKCE, are more likely to be exposed.
Exploit preconditions
- Attack surface: OAuth 2.0 / OpenID Connect endpoints exposed by better-auth.
- Required access: Network-level access to interact as, or with, a client application; ability to influence algorithm/PKCE selection or intercept traffic.
- Trigger point: Authorization and token exchange flows where the server advertises "none" as a supported algorithm or accepts PKCE "plain" instead of S256.
- Why exploitation is possible: The cryptographic policy allows negotiation of weak or non-existent protection (e.g., "none" algorithm, plain PKCE), enabling downgrade and interception attacks against otherwise protected flows.
Why this happens
The root cause is the use of insecure cryptographic defaults in the authentication framework.
By advertising the "none" algorithm in OIDC metadata and accepting plain PKCE, the implementation effectively permits token processing without strong integrity or code-verifier protection.
This aligns with CWE-327: Use of a Broken or Risky Cryptographic Algorithm, where cryptographic mechanisms are configured in a way that undermines their intended security guarantees.
Potential impact
- Attackers could obtain or forge access tokens by exploiting unsigned or weakly protected tokens.
- Authorization codes may be intercepted and redeemed by unauthorized parties when PKCE plain is used.
- Sessions could be hijacked, leading to unauthorized access to protected resources.
- Downstream applications may rely on compromised identity assertions, enabling broader impersonation or privilege escalation.
General mitigation guidance
Mitigation generally focuses on tightening cryptographic policy and removing insecure options.
Typical safeguards include:
- Disabling support for the "none" algorithm and any other non-signed or non-validated token formats.
- Enforcing PKCE S256 as the only acceptable method for authorization code flows, rejecting plain PKCE.
- Applying strict algorithm whitelists for ID tokens and access tokens, aligned with current best practices.
- Configuring clients and servers to fail closed when encountering unsupported or weaker algorithms or PKCE methods.
- Reducing reliance on auto-negotiated defaults by explicitly setting cryptographic requirements in configuration.
How teams detect issues like this
Secure teams often detect this class of issue by:
- Reviewing OIDC discovery documents and configuration metadata for the presence of "none" or weak algorithms.
- Using static analysis or configuration linting to flag acceptance of PKCE plain or other downgraded mechanisms.
- Incorporating code review checklists that call out cryptographic defaults, algorithm negotiation, and PKCE handling.
- Employing automated security tests that attempt to complete OIDC/OAuth flows using "none" algorithms or plain PKCE and observing whether they are accepted.
