CVE-2026-53512 Details
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
A vulnerability exists in the Better Auth library for TypeScript, specifically in versions prior to 1.6.11, within the legacy OIDC provider and MCP plugins. These plugins expose OAuth token endpoints that improperly handle refresh token grants for confidential clients. The refresh token grant only verifies possession of the refresh token and the client ID, without requiring the client secret. This oversight allows an attacker with a valid refresh token to generate access tokens and new refresh tokens through the OIDC or MCP token endpoints. The issue arises because the plugins do not authenticate confidential clients correctly on the refresh token grant, creating a risk of unauthorized access.
Users can upgrade to Better Auth version 1.6.11 or later, which fixes the vulnerability by requiring client secrets for confidential clients on the refresh token grant. If an immediate upgrade is not possible, consider migrating to the @better-auth/oauth-provider package, which is not affected by this vulnerability and enforces client authentication on both grants by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth better auth | < 1.6.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |