CVE-2026-53512: Better Auth authentication bypass in legacy OIDC and MCP plugins

CVE-2026-53512 · Severity: critical · CVSS 9.1 · Published 2026-07-15

Better Auth is a security library used by developers to handle user logins and permissions in TypeScript applications. A flaw in its legacy OIDC and MCP plugins allowed attackers who obtained a refresh token to generate new access tokens without knowing the application's secret key. This could lead to unauthorized account access and the ability for an attacker to maintain a persistent foothold in a user's account even if the original session was intended to be protected.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-53512 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53512 being exploited in the wild.
How severe is CVE-2026-53512?
Critical severity, with a CVSS score of 9.1, published 15 July 2026.
Which products and versions are affected?
better-auth (npm) < 1.6.11, SEMVER:introduced=0,fixed=1.6.11.
Is there a fix for CVE-2026-53512?
Yes. better-auth (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53512 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53512?
Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • better-auth (npm): upgrade to 1.6.11 or later
    npm install better-auth@1.6.11

Technical details

The vulnerability exists in the legacy oidcProvider and mcp plugins of Better Auth. While the library correctly requires a client_secret for the initial authorization_code exchange, it fails to enforce this requirement for the refresh_token grant. An attacker who obtains a valid refresh_token (e.g., via local storage leak or proxy logs) can call the /api/auth/oauth2/token or /api/auth/mcp/token endpoints to obtain new access tokens and rotated refresh tokens by providing only the token and a matching client_id. This bypasses the authentication requirements for confidential clients. The issue is addressed in version 1.6.11 by requiring the client_secret for confidential clients and implementing constant-time string comparisons.

Affected products

  • better-auth better-auth < 1.6.11

Identifiers

  • CVE-2026-53512
  • GHSA-pw9m-5jxm-xr6h

Timeline

  • 2026-05-12: patched: Fix committed and version 1.6.11 released.
  • 2026-07-15: disclosed: CVE-2026-53512 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.