CVE-2026-67332

Name of the Vulnerable Software and Affected Versions @better-auth/oauth-provider versions prior to 1.7.0-beta.4

Description @better-auth/oauth-provider fails to bind the access-token audience to the authorization grant, which allows clients to request tokens for unrelated resources. This occurs because the provider accepts the resource parameter only at the token endpoint and does not record requested resources on the authorization code or refresh-token row. Consequently, a client can obtain a JWT access token targeting a resource server that the user's authorization never covered, provided the resource is in the server's validAudiences allowlist. This behavior diverges from RFC 8707, as the token endpoint should only narrow, not widen, the authorized resources. The issue affects the /oauth2/token endpoint and the aud claim in JWTs. An attacker can bypass intended authorization boundaries to use a token granted for one resource at another, although access remains limited to the granted scopes.

Recommendations Upgrade to @better-auth/oauth-provider version 1.7.0-beta.4 or later and run the schema migration using npx auth migrate. As a temporary workaround, set validAudiences to a single audience or leave it unset to use the default base URL. Configure resource servers to accept tokens only when their own identifier is the expected audience and reject tokens where the aud claim is an array containing other audiences. Avoid relying on the resource indicator as an authorization boundary until the fix is applied.