Junglewise Threat Intelligence

CVE-2026-53517: Better Auth race condition in OAuth refresh token rotation

CVE-2026-53517 · Severity: high · CVSS 8.1 · Published 2026-07-15

Executive brief

Better Auth is an open-source authentication and authorization library used to manage user sessions and OAuth token flows in web applications. A race condition in its OAuth refresh-token rotation logic allows concurrent requests to fork a single refresh token into multiple valid tokens. An attacker with a stolen refresh token can exploit timing to create multiple independent token branches, each granting indefinite access until revoked or expired, while bypassing family-invalidation safeguards that would normally lock down the entire token family.

Technical details

The vulnerability is a time-of-check time-of-use (TOCTOU) race condition and concurrent-execution synchronization failure (CWE-362, CWE-367) in the POST /oauth2/token endpoint's refresh_token grant handler. The adapter.update predicate checks only the oauthRefreshToken row's id field, not the revoked flag, allowing two concurrent updates to both succeed. The revocation check is not atomic with the token mint operation, so both concurrent requests pass validation before either marks the parent token revoked. The result is a forked refresh-token family: multiple valid tokens derived from one parent, each with independent lifetimes (default 7 days) that reset on each rotation. An attacker holding any branch survives single-token revocations. The fix (version 1.6.11) implements atomic compare-and-swap (UPDATE ... WHERE id = ? AND revoked IS NULL with rowcount validation) in the rotation primitive, ensuring only one concurrent request succeeds and the parent row stays marked revoked. A unique constraint on oauthRefreshToken.token also prevents collisions from buggy token-generation callbacks.

Affected products

  • Better Auth @better-auth/oauth-provider >=1.6.0, <1.6.11
  • Better Auth better-auth >=1.4.8-beta.7, <1.6.0
  • Better Auth @better-auth/memory-adapter >=1.6.0, <1.6.11

Timeline

  • 2026-07-07: disclosed: GHSA-392p-2q2v-4372 published
  • 2026-05-12: patched: Fix merged in @better-auth/oauth-provider@1.6.11

References

Related threats