Executive brief
A vulnerability in the Better Auth OAuth provider library allows an attacker to obtain access tokens for unauthorized services. This occurs because the system does not properly verify that the requested resource matches the original user authorization. In practice, an attacker could use a valid login to gain access to other internal data or services that they were never granted permission to use.
Technical details
The @better-auth/oauth-provider library fails to bind the RFC 8707 'resource' parameter to the original authorization grant. During the OAuth flow, the provider validates requested resources against a global allowlist at the token endpoint but does not verify them against the resources requested at the authorization endpoint. This allows a client to complete a valid authorization flow and then request a JWT access token for any audience in the 'validAudiences' list, regardless of whether the user authorized that specific resource. The same issue affects refresh tokens, which can be redeemed for access tokens targeting different allowlisted resources. The vulnerability is fixed in version 1.7.0-beta.4 by recording requested resources during authorization and enforcing subset narrowing at the token endpoint.
Affected products
- better-auth @better-auth/oauth-provider >= 1.4.8, < 1.7.0-beta.4
Timeline
- 2026-05-31: patched: Version 1.7.0-beta.4 released
- 2026-07-07: advisory: GitHub Advisory GHSA-p2fr-6hmx-4528 published