CVE-2026-53517
CVE-2026-53517 · Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.
CVSS 8.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
better-auth
- Versions
- >= 1.4.8-beta.7, < 1.6.0: Affected
No fix published
oauth-provider
- Versions
- >= 1.6.0, < 1.6.11: Affected
No fix published
@better-auth/oauth-provider npm
- Affected ranges
- SEMVER: ≥ 1.6.0, < 1.6.11
Update to 1.6.11
better-auth npm
- Affected ranges
- SEMVER: ≥ 1.4.8-beta.7, < 1.6.0
Update to 1.6.0