Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-53512: better-auth library allows token abuse with stolen refresh token
CVE-2026-53512 · published 3 months ago
Summary
The better-auth authentication library (versions before 1.6.11) lets anyone who obtains a refresh token create new access tokens and new refresh tokens without proving they are the legitimate client. This means an attacker could keep accessing protected resources even after the original token is revoked. Upgrade to version 1.6.11 or later to add the required client secret check and stop the abuse.
What to do
- Update GitHub Actions better-auth to version 1.6.11.
- Update better-auth better_auth to version 1.6.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | better-auth |
< 1.6.11 Fix: upgrade to 1.6.11
|
| – | better-auth | better-auth | < 1.6.11 |
| – | better-auth | better_auth |
< 1.6.11 cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* |
Original advisory text
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
References
- https://github.com/advisories/GHSA-pw9m-5jxm-xr6h
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11 URL
- https://github.com/better-auth/better-auth/security/advisories/GHSA-pw9m-5jxm-xr... Vendor Advisory
- https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c... Patch
- https://github.com/better-auth/better-auth/pull/9576 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-53512 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53512... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-287Improper Authentication
CWE-306Missing Authentication for Critical Function
CWE-345Insufficient Verification of Data Authenticity
CWE-863Incorrect Authorization
Timeline
Published15 Jul 2026
Updated3 Nov 2026
First seen7 Jul 2026
Track software like this
Free during beta