Skip to content
Fencer Intel
high 8.1

CVE-2026-53517 json

Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

published 5mo ago modified last mo. also EUVD-2026-44745 , GHSA-392p-2q2v-4372

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

Patch / fix

  • npm @better-auth/oauth-provider 1.6.11
  • npm better-auth 1.6.0
  • better-auth better-auth/oauth-provider 1.6.11
  • better-auth better_auth 1.6.11

Is CVE-2026-53517 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm @better-auth/oauth-provider
>=1.6.0, <1.6.11
1.6.11
npm better-auth
>=1.4.8-beta.7, <1.6.0
1.6.0

Affected products

  • better-auth better-auth
  • @better-auth oauth-provider

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of better-auth/better-auth published their own advisory on GitHub. Reviewed sources take precedence over it.