https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:16:49.140493+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338134 EUVD-2026-338134 2026-10-08T06:16:49.146786+00:00 EUVD-2026-338134 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53517 fkie_cve-2026-53517 2026-10-08T06:16:49.146888+00:00

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

 https://cve.radiocsirt.org/vuln/ghsa-392p-2q2v-4372 GHSA-392p-2q2v-4372 — Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption 2026-10-08T06:16:49.146969+00:00

Affected: npm: @better-auth/oauth-provider, npm: better-auth

### Am I affected?

Users are affected if all of the following are true:

- Their project depends on `@better-auth/oauth-provider` at a version `>= 1.6.0, < 1.6.11`, or uses the embedded plugin in `better-auth >= 1.4.8-beta.7, < 1.6.0`. - At least one OAuth client served by their application's authorization server requests the `offline_access` scope, so refresh tokens are minted. - Concurrent redemption of the same refresh token is reachable: an SPA shares one refresh token across browser tabs without a mutex, a mobile client retries after a transient failure, an attacker who has stolen a refresh token times two requests, or a service worker queues offline requests.

If developer applications do not request `offline_access` for any client, no refresh tokens are minted and they are not exposed.

Fix:

1. Upgrade to `@better-auth/oauth-provider@1.6.11` or later. 2. If developers cannot upgrade, see workarounds below.

### Summary

The OAuth provider's `POST /oauth2/token` endpoint, on the `refresh_token` grant, performs a non-atomic read / validate / revoke / mint sequence on the `oauthRefreshToken` row. Two concurrent requests presenting the same parent refresh token both pass the revocation check before either revoke completes, so each mints a fresh refresh token. The replay-detection branch only fires when `revoked` is already truthy at read time, which is exactly the state concurrent attackers race past. The result is a forked refresh-token family from a single parent toke…