better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plai…

better-auth versions prior to 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins. The plugins advertise the 'none' algorithm and accept plain PKCE by default, which are both insecure configurations. Attackers can exploit algorithm negotiation to have systems accept unsigned tokens, bypassing authentication integrity checks. Additionally, when PKCE plain is used instead of the required S256 method, attackers can intercept authorization codes. The vulnerability affects the OAuth/OIDC authentication flow, posing significant identity and access risks. A fix was released in version 1.6.11 of better-auth. The issue has been documented in a GitHub Security Advisory (GHSA-9h47-pqcx-hjr4) and VulnCheck advisories.