better-auth Better Auth up to 1.6.10 OAuth2 Token Endpoint /oauth2/token authorization_code improper authorization

Summaryinfo

A vulnerability was found in better-auth Better Auth up to 1.6.10 and classified as critical. This affects an unknown part of the file /oauth2/token of the component OAuth2 Token Endpoint. Executing a manipulation of the argument authorization_code can lead to improper authorization. This vulnerability appears as CVE-2026-53518. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in better-auth Better Auth up to 1.6.10. It has been declared as critical. This vulnerability affects an unknown code of the file /oauth2/token of the component OAuth2 Token Endpoint. The manipulation of the argument authorization_code with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53518 since 06/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 1.6.11 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• better-auth

Name

• Better Auth

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion