CVE-2026-53512

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Better Auth Library

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-53512

EUVD

EUVD-2026-44735

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better_auth	to 1.6.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Better Auth library's legacy OIDC provider and MCP plugins before version 1.6.11. It allows an attacker with a valid refresh token to obtain new access tokens and rotated refresh tokens without verifying the client's secret, enabling impersonation attacks.

Detection Guidance

To detect this vulnerability, check if your Better Auth instance uses versions below 1.6.11 for the legacy oidcProvider or mcp plugins. Inspect network traffic for unauthorized token requests to /api/auth/oauth2/token or /api/auth/mcp/token without client_secret validation for confidential clients.

Impact Analysis

An attacker could gain indefinite access to user accounts by exploiting refresh tokens, leading to unauthorized actions or data breaches. Systems using affected plugins may face impersonation risks and unauthorized resource access until patched.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access control, such as GDPR's integrity principles or HIPAA's access controls, due to unauthorized access risks and potential data breaches.

Mitigation Strategies

Upgrade to Better Auth version 1.6.11 or later. If using legacy plugins, migrate to the newer @better-auth/oauth-provider package. For confidential clients, enforce client_secret validation during refresh token exchanges. Restrict network access to token endpoints as a temporary measure.

Hi! I’m here to help you understand CVE-2026-53512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70