CVE-2026-53518
CVE-2026-53518 · Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.
CVSS 7.6 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
better-auth
- Versions
- >= 1.6.0, < 1.6.11: Affected
No fix published
@better-auth/oauth-provider npm
- Affected ranges
- SEMVER: ≥ 1.6.0, < 1.6.11
Update to 1.6.11
better-auth npm
- Affected ranges
- SEMVER: < 1.6.11
Update to 1.6.11