CVE-2026-53517 Details

A vulnerability exists in the Better Auth authentication and authorization library for TypeScript, specifically in the OAuth provider's refresh token grant handling. This issue is present in versions 1.4.8-beta.7 prior to 1.6.11, including embedded Better Auth plugin versions before 1.6.0. The vulnerability arises from a non-atomic sequence of read, validate, revoke, and mint operations on the OAuth refresh token, allowing concurrent requests with the same parent refresh token to bypass revocation checks and create forked refresh token families. The problem is exacerbated for clients requesting the 'offline_access' scope, as it enables the use of refresh tokens across multiple sessions or tabs, creating opportunities for abuse.

Users can upgrade to Better Auth versions 1.6.11 or later. If an immediate upgrade is not possible, consider configuring the database adapter to run the OAuth refresh handler under serializable isolation, or wrap the 'adapter.update' on 'oauthRefreshToken' with a row-level pessimistic lock. As a temporary measure, the 'offline_access' scope can be disabled to prevent refresh tokens from being minted.