TI-2026-38592 Aliases CVE-2026-53518 GHSA-7w99-5wm4-3g79

Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption

LOW 35CWE-362Published 2026-07-15 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00409 35th percentileScored 2026-11-07

Fix Fixed better-auth (better-auth): 1.6.11@better-auth/oauth-provider (npm): 1.6.11+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
better-auth	better-auth	1.6.0 to before 1.6.11	1.6.11	Patch available	CNA
—	@better-auth/oauth-provider (npm)	1.6.0 to before 1.6.11	1.6.11	Patch available	GHSA-7w99-5wm4-3g79
—	better-auth (npm)	before 1.6.11	1.6.11	Patch available	GHSA-7w99-5wm4-3g79

better-auth Vendorbetter-auth Affected 1.6.0 to before 1.6.11 Fixed in 1.6.11 Patch available CNA
@better-auth/oauth-provider (npm) Vendor— Affected 1.6.0 to before 1.6.11 Fixed in 1.6.11 Patch available GHSA-7w99-5wm4-3g79
better-auth (npm) Vendor— Affected before 1.6.11 Fixed in 1.6.11 Patch available GHSA-7w99-5wm4-3g79

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:better-auth:better-auth\/oauth-provider::::::node.js::*	1.6.0 to before 1.6.11	Vulnerable	better-auth
cpe:2.3:a:better-auth:better_auth::::::node.js::*	1.6.0 to before 1.6.11	Vulnerable	better-auth

cpe:2.3:a:better-auth:better-auth\/oauth-provider:*:*:*:*:*:node.js:*:* Versions 1.6.0 to before 1.6.11 Vulnerable ·better-auth
cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* Versions 1.6.0 to before 1.6.11 Vulnerable ·better-auth

Remediation

Fix · CNA better-auth (better-auth) Fixed in 1.6.11
Fix · GHSA-7w99-5wm4-3g79 @better-auth/oauth-provider (npm) Fixed in 1.6.11 Advisory →
Fix · GHSA-7w99-5wm4-3g79 better-auth (npm) Fixed in 1.6.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-53518
2026-10-03 Alias added: GHSA-7w99-5wm4-3g79

References

Patch 1

https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9

Advisory 2

Other 2

TI-2026-38591 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking CVSS 3.1HIGH 8.1
TI-2026-30026 Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences