CVE-2026-53518: Better Auth race condition in OAuth authorization code redemption

CVE-2026-53518 · Severity: high · CVSS 8.1 · Published 2026-07-15

Better Auth is a security library used by developers to handle user logins and permissions in TypeScript applications. A flaw in how it handles OAuth login codes allows an attacker to potentially use the same single-use code twice by sending two requests at the exact same time. This could allow unauthorized parties to generate multiple valid login tokens, potentially leading to unauthorized account access or session hijacking.

Technologies: Better-Auth Oauth-Provider, @better-auth/oauth-provider (npm), better-auth (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-53518 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53518 being exploited in the wild.
How severe is CVE-2026-53518?
High severity, with a CVSS score of 8.1, published 15 July 2026.
Which products and versions are affected?
Better-Auth Oauth-Provider >= 1.6.0, < 1.6.11; @better-auth/oauth-provider (npm) >= 1.6.0, < 1.6.11, SEMVER:introduced=1.6.0,fixed=1.6.11; better-auth (npm) < 1.6.11, SEMVER:introduced=0,fixed=1.6.11.
Is there a fix for CVE-2026-53518?
Yes. @better-auth/oauth-provider (npm): upgrade to 1.6.11 or later; better-auth (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53518 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53518?
Check whether you run Better-Auth Oauth-Provider, @better-auth/oauth-provider (npm) or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @better-auth/oauth-provider (npm): upgrade to 1.6.11 or later
    npm install @better-auth/oauth-provider@1.6.11
  • better-auth (npm): upgrade to 1.6.11 or later
    npm install better-auth@1.6.11

Technical details

A race condition (CWE-362/CWE-367) exists in the @better-auth/oauth-provider POST /oauth2/token endpoint and related legacy paths (oidc-provider and mcp plugins). The vulnerability stems from a non-atomic 'find-then-delete' sequence when redeeming single-use authorization codes. Because the read and delete operations are not synchronized, two concurrent requests can both pass the initial check before the code is deleted, resulting in the issuance of multiple sets of access, refresh, and ID tokens. This violates the single-use requirement of RFC 6749 §4.1.2. The issue is resolved in version 1.6.11 by implementing an atomic 'consume' primitive (internalAdapter.consumeVerificationValue) that ensures only the first request succeeds.

Affected products

  • better-auth better-auth/oauth-provider >= 1.6.0, < 1.6.11
  • better-auth better-auth >= 1.4.8-beta.7, < 1.6.11

Identifiers

  • CVE-2026-53518
  • GHSA-7w99-5wm4-3g79

Timeline

  • 2026-05-12: patched: Fix committed and version 1.6.11 released.
  • 2026-05-31: advisory: GitHub Security Advisory GHSA-7w99-5wm4-3g79 published.
  • 2026-07-15: disclosed: CVE-2026-53518 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.