Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-53518: Better Auth OAuth provider can issue duplicate tokens
CVE-2026-53518 · published 3 months ago
Summary
Versions 1.6.0 through 1.6.11 of Better Auth’s OAuth component may give out more than one set of tokens for a single sign‑in code when two requests happen at the same time. This could let someone obtain extra access tokens and use them to act as the original user. Updating the library to version 1.6.11 or later resolves the issue.
What to do
- Update better-auth oauth-provider to version 1.6.11.
- Update GitHub Actions better-auth to version 1.6.11.
- Update better-auth @better-auth/oauth-provider to version 1.6.11.
- Update better-auth better-auth\/oauth-provider to version 1.6.11 or later.
- Update better-auth better_auth to version 1.6.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | better-auth | oauth-provider |
>= 1.6.0, < 1.6.11 Fix: upgrade to 1.6.11
|
| npm | GitHub Actions | better-auth |
< 1.6.11 Fix: upgrade to 1.6.11
|
| npm | better-auth | @better-auth/oauth-provider |
>= 1.6.0, < 1.6.11 Fix: upgrade to 1.6.11
|
| – | better-auth | better-auth | >= 1.6.0, < 1.6.11 |
| – | better-auth | better-auth\/oauth-provider |
>= 1.6.0, < 1.6.11 cpe:2.3:a:better-auth:better-auth\/oauth-provider:*:*:*:*:*:node.js:*:* |
| – | better-auth | better_auth |
>= 1.6.0, < 1.6.11 cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* |
Original advisory text
Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.
References
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11 URL
- https://github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g... Vendor Advisory
- https://github.com/advisories/GHSA-7w99-5wm4-3g79
- https://github.com/better-auth/better-auth Product
- https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6f... Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-53518 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53518... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-294Authentication Bypass by Capture-replay
CWE-362Race Condition
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published15 Jul 2026
Updated4 Nov 2026
First seen7 Jul 2026
Sources
GHSA-7w99-5wm4-3g79 · GHSA
CVE-2026-53518 · NVD
GHSA-7w99-5wm4-3g79 · OSV
CVE-2026-53518 · MITRE
CVE-2026-53518 · OSV
Track software like this
Free during beta