better-auth up to 1.6.10 OAuth Provider /oauth2/token refresh_token improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in better-auth up to 1.6.10. This impacts an unknown function of the file /oauth2/token of the component OAuth Provider. The manipulation of the argument refresh_token leads to improper authorization. This vulnerability is referenced as CVE-2026-53517. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in better-auth up to 1.6.10 and classified as critical. This issue affects an unknown code of the file /oauth2/token of the component OAuth Provider. The manipulation of the argument refresh_token with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-53517 since 06/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 1.6.11 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• better-auth

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10

Website

• Product: https://github.com/better-auth/better-auth/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion