CVE-2026-53518

Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions 1.6.0 through 1.6.10 better-auth versions 1.4.8-beta.7 through 1.6.10

Description The POST /oauth2/token endpoint for the authorization code grant redeems a single-use authorization code using a non-atomic find-then-delete sequence. This creates a race condition where two concurrent requests using the same code variable can both pass the read step before the deletion occurs. Consequently, both requests can successfully mint independent sets of access tokens, refresh tokens, and ID tokens, violating the single-use requirement for authorization codes. This issue also affects the legacy /oauth2/token and /mcp/token paths within the oidc-provider and mcp plugins.

Recommendations Upgrade @better-auth/oauth-provider to version 1.6.11 or later. Upgrade better-auth to version 1.6.11 or later for those using legacy plugin paths. As a temporary mitigation, deploy a reverse proxy to serialize concurrent requests for the same code parameter. As a temporary mitigation, implement a database uniqueness constraint to prevent multiple tokens from being created with the same upstream code reference. As a temporary mitigation, wrap deleteVerificationByIdentifier with a custom hook that uses adapter.deleteMany to detect and reject duplicate claims.