# CVE-2026-53517: Better Auth race condition in OAuth refresh token rotation

Source: https://junglewise.ai/threats/cve-2026-53517-better-auth-race-condition-in-oauth-refresh-token-rotation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-53517 · Severity: high · CVSS 8.1 · Published 2026-07-15

Better Auth is an open-source authentication and authorization library used to manage user sessions and OAuth token flows in web applications. A race condition in its OAuth refresh-token rotation logic allows concurrent requests to fork a single refresh token into multiple valid tokens. An attacker with a stolen refresh token can exploit timing to create multiple independent token branches, each granting indefinite access until revoked or expired, while bypassing family-invalidation safeguards that would normally lock down the entire token family.

Technologies: [Better-Auth Oauth-Provider](https://junglewise.ai/threats/technologies/oauth-provider), [@better-auth/oauth-provider (npm)](https://junglewise.ai/threats/technologies/better-auth-oauth-provider), [better-auth (npm)](https://junglewise.ai/threats/technologies/better-auth). Vendors: [Better-Auth](https://junglewise.ai/threats/vendors/better-auth), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53517 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53517 being exploited in the wild.

**How severe is CVE-2026-53517?** High severity, with a CVSS score of 8.1, published 15 July 2026.

**Which products and versions are affected?** Better-Auth Memory-Adapter >=1.6.0, <1.6.11; Better-Auth OAuth Provider Plugin >= 1.6.0, < 1.6.11; Better-Auth Oauth-Provider >= 1.6.0, < 1.6.11, >=1.6.0, <1.6.11; @better-auth/oauth-provider (npm) >= 1.6.0, < 1.6.11, SEMVER:introduced=1.6.0,fixed=1.6.11; and 1 more.

**Is there a fix for CVE-2026-53517?** Yes. @better-auth/oauth-provider (npm): upgrade to 1.6.11 or later; better-auth (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53517 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53517?** Check whether you run Better-Auth Memory-Adapter, Better-Auth OAuth Provider Plugin, Better-Auth Oauth-Provider or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @better-auth/oauth-provider (npm): upgrade to 1.6.11 or later

  ```sh
  npm install @better-auth/oauth-provider@1.6.11
  ```

- better-auth (npm): upgrade to 1.6.0 or later

  ```sh
  npm install better-auth@1.6.0
  ```


## Technical details

The vulnerability is a time-of-check time-of-use (TOCTOU) race condition and concurrent-execution synchronization failure (CWE-362, CWE-367) in the POST /oauth2/token endpoint's refresh_token grant handler. The adapter.update predicate checks only the oauthRefreshToken row's id field, not the revoked flag, allowing two concurrent updates to both succeed. The revocation check is not atomic with the token mint operation, so both concurrent requests pass validation before either marks the parent token revoked. The result is a forked refresh-token family: multiple valid tokens derived from one parent, each with independent lifetimes (default 7 days) that reset on each rotation. An attacker holding any branch survives single-token revocations. The fix (version 1.6.11) implements atomic compare-and-swap (UPDATE ... WHERE id = ? AND revoked IS NULL with rowcount validation) in the rotation primitive, ensuring only one concurrent request succeeds and the parent row stays marked revoked. A unique constraint on oauthRefreshToken.token also prevents collisions from buggy token-generation callbacks.

## Affected products

- Better Auth @better-auth/oauth-provider >=1.6.0, <1.6.11
- Better Auth better-auth >=1.4.8-beta.7, <1.6.0
- Better Auth @better-auth/memory-adapter >=1.6.0, <1.6.11

## Identifiers

- CVE-2026-53517
- GHSA-392p-2q2v-4372

## Timeline

- 2026-07-07: disclosed: GHSA-392p-2q2v-4372 published
- 2026-05-12: patched: Fix merged in @better-auth/oauth-provider@1.6.11

## References

- [https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372](https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372)
- [https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d](https://github.com/better-auth/better-auth/commit/c6918ecc9e3a75892169415d7f6c95b591b6a52d)
- [https://github.com/better-auth/better-auth](https://github.com/better-auth/better-auth)
- [https://github.com/better-auth/better-auth/releases/tag/v1.6.0](https://github.com/better-auth/better-auth/releases/tag/v1.6.0)
- [https://github.com/better-auth/better-auth/releases/tag/v1.6.11](https://github.com/better-auth/better-auth/releases/tag/v1.6.11)

## Related threats

- [Better Auth authentication bypass in Magic Link and OAuth](https://junglewise.ai/threats/cve-2026-114607-better-auth-is-an-authentication-and-authorization-library-for)
- [Better Auth OAuth Proxy authentication bypass](https://junglewise.ai/threats/cve-2026-110864-better-auth-from-1-5-0-beta-12-before-1-7-7-contains-an)
- [Better Auth authentication bypass via OAuth state reuse](https://junglewise.ai/threats/cve-2026-110862-better-auth-from-1-4-0-beta-18-before-1-7-7-contains-an)
- [@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL](https://junglewise.ai/threats/cve-2026-110861-better-auth-better-auth-drizzle-adapter-and-better-auth-from-1-6)
- [better-auth device authorization UI misrepresentation in deviceAuthorization plugin](https://junglewise.ai/threats/cve-2026-109346-better-auth-from-1-3-8-beta-3-before-1-7-0-rc-3-contains-a-ui)