CVE-2026-53517

Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions 1.6.0 through 1.6.10 better-auth versions 1.4.8-beta.7 through 1.5.x

Description The @better-auth/oauth-provider POST /oauth2/token endpoint is susceptible to a race condition during the refresh token grant process. The system performs a non-atomic sequence of reading, validating, revoking, and minting the oauthRefreshToken row. This allows concurrent requests using the same parent refresh token to bypass the revocation check, resulting in the creation of forked refresh-token families. This issue can lead to indefinite unauthorized access if a refresh token is stolen, as the attacker can maintain a valid token branch that survives individual revocations. The flaw exists because the update predicate is keyed only on the ID and does not verify that the token is not already revoked, and the database schema lacks a unique constraint on the token field.

Recommendations Upgrade @better-auth/oauth-provider to version 1.6.11 or later. Upgrade better-auth to version 1.6.0 or later. As a temporary mitigation, do not request the offline access scope to prevent the minting of refresh tokens. As a temporary mitigation, set refreshTokenExpiresIn to a very low value (e.g., 60 seconds) to limit the persistence of forked token families. As a temporary mitigation, configure the database adapter to run the OAuth refresh handler under serializable isolation or use a row-level pessimistic lock (SELECT ... FOR UPDATE) on the oauthRefreshToken table. Manually add a unique constraint to the oauthRefreshToken.token column in the database to provide defense-in-depth.