Dvanmali

**Name of the Vulnerable Software and Affected Versions** @better-auth/oauth-provider versions prior to 1.7.0-beta.4 **Description** @better-auth/oauth-provider fails to bind the access-token audience to the authorization grant, which allows clients to request tokens for unrelated resources. This occurs because the provider accepts the `resource` parameter only at the token endpoint and does not record requested resources on the authorization code or refresh-token row. Consequently, a client can obtain a JWT access token targeting a resource server that the user's authorization never covered, provided the resource is in the server's `validAudiences` allowlist. This behavior diverges from RFC 8707, as the token endpoint should only narrow, not widen, the authorized resources. The issue affects the `/oauth2/token` endpoint and the `aud` claim in JWTs. An attacker can bypass intended authorization boundaries to use a token granted for one resource at another, although access remains limited to the granted scopes. **Recommendations** Upgrade to @better-auth/oauth-provider version 1.7.0-beta.4 or later and run the schema migration using `npx auth migrate`. As a temporary workaround, set `validAudiences` to a single audience or leave it unset to use the default base URL. Configure resource servers to accept tokens only when their own identifier is the expected audience and reject tokens where the `aud` claim is an array containing other audiences. Avoid relying on the `resource` indicator as an authorization boundary until the fix is applied.