CVE-2026-53518

Analyzed Analyzed - Analysis Complete

Authentication Code Reuse in Better Auth Library

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-53518

EUVD

EUVD-2026-44734

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better_auth	From 1.6.0 (inc) to 1.6.11 (exc)
better-auth	better-auth/oauth-provider	From 1.6.0 (inc) to 1.6.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Better Auth library's OAuth authorization code grant flow. It allows two concurrent requests to redeem the same single-use authorization code, bypassing the intended single-use restriction. The issue occurs because the code verification uses a non-atomic find-then-delete sequence, letting both requests pass the initial check before either deletes the code.

Detection Guidance

To detect this vulnerability, monitor for multiple successful token issuances from the same authorization code. Check logs for concurrent POST /oauth2/token requests with identical authorization codes returning valid tokens. Look for duplicate token sets (access, refresh, ID) issued in quick succession from the same client IP.

Impact Analysis

This vulnerability enables authentication bypass via replay attacks. An attacker could exploit the race condition to obtain multiple valid access tokens, refresh tokens, and ID tokens using a single authorization code. This could lead to unauthorized access to user accounts and data.

Compliance Impact

This vulnerability violates OAuth 2.0 RFC 6749 requirements for single-use authorization codes, potentially compromising authentication integrity. It may lead to unauthorized data access, impacting compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive information.

Mitigation Strategies

Immediately upgrade to Better Auth version 1.6.11 or later. If upgrading is not possible, implement network-level rate limiting on /oauth2/token endpoints and database-level constraints to prevent duplicate authorization code usage. Disable affected legacy plugins if not essential.

Hi! I’m here to help you understand CVE-2026-53518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70