Executive brief
Better Auth is a security library used by developers to handle user logins and permissions in TypeScript applications. A flaw in how it handles OAuth login codes allows an attacker to potentially use the same single-use code twice by sending two requests at the exact same time. This could allow unauthorized parties to generate multiple valid login tokens, potentially leading to unauthorized account access or session hijacking.
Technical details
A race condition (CWE-362/CWE-367) exists in the @better-auth/oauth-provider POST /oauth2/token endpoint and related legacy paths (oidc-provider and mcp plugins). The vulnerability stems from a non-atomic 'find-then-delete' sequence when redeeming single-use authorization codes. Because the read and delete operations are not synchronized, two concurrent requests can both pass the initial check before the code is deleted, resulting in the issuance of multiple sets of access, refresh, and ID tokens. This violates the single-use requirement of RFC 6749 §4.1.2. The issue is resolved in version 1.6.11 by implementing an atomic 'consume' primitive (internalAdapter.consumeVerificationValue) that ensures only the first request succeeds.
Affected products
- better-auth better-auth/oauth-provider >= 1.6.0, < 1.6.11
- better-auth better-auth >= 1.4.8-beta.7, < 1.6.11
Timeline
- 2026-05-12: patched: Fix committed and version 1.6.11 released.
- 2026-05-31: advisory: GitHub Security Advisory GHSA-7w99-5wm4-3g79 published.
- 2026-07-15: disclosed: CVE-2026-53518 published to NVD.