The better-auth library versions prior to 1.6.11, when using the legacy oidcProvider or mcp plugins, have insecure cryptographic defaults. These include advertising the 'none' algorithm for ID token signing in the discovery document, which can lead to acceptance of unsigned tokens by relying parties that do not pin algorithms. Additionally, the default acceptance of the PKCE 'plain' code challenge method violates OAuth 2.1 standards and weakens authorization code protection if the authorization URL is exposed. The newer @better-auth/oauth-provider package is not affected. A fix is available in better-auth version 1.6.11 and later.