p PatchFirst

CVE-2026-53512

CVE-2026-53512 · Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.

CVSS 9.1 · Critical · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • better-auth

    Versions
    • < 1.6.11: Affected

    No fix published

  • better-auth npm

    Affected ranges
    • SEMVER: < 1.6.11

    Update to 1.6.11

Original sources

Check your server →