CVE-2026-53518 Details
Description
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.
A vulnerability exists in the Better Auth authentication and authorization library for TypeScript, specifically in the OAuth provider's authorization code grant implementation. Versions 1.6.0 prior to 1.6.11 are affected. The vulnerability arises because the token exchange process for authorization codes is handled in a non-atomic manner, allowing two concurrent requests to the /oauth2/token endpoint to both redeem the same authorization code. This results in the issuance of multiple sets of access tokens, refresh tokens, and ID tokens from a single authorization code, violating the OAuth 2.0 specification that requires authorization codes to be single-use. The same issue is present in the legacy OIDC provider and MCP plugins, which share the same underlying code.
Upgrade to @better-auth/oauth-provider version 1.6.11 or later. If using the legacy OIDC provider or MCP plugins, upgrade Better Auth to version 1.6.11 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth better-auth/oauth-provider | >= 1.6.0, < 1.6.11 |
CPE
Remediation
| |
| better-auth better auth | >= 1.6.0, < 1.6.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |