Skip to content
OpenAdvisories

Package · npm

@better-auth/oauth-provider

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-53517

    Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

    Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence o…

    better-auth better-auth oauth-provider better-auth npm
  • High 7.6
    CVE-2026-53518

    Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption

    Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-…

    better-auth better-auth better-auth @better-auth/oauth-provider npm
  • High 7.1
    CVE-2026-41427

    Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients

    Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that c…

    better-auth better-auth oauth-provider @better-auth/oauth-provider npm