https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 06:31:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338601 EUVD-2026-338601 https://cve.radiocsirt.org/vuln/euvd-2026-338601 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53512 <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client&#39;s client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.</p> <p>Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client&#39;s client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53512 https://cve.radiocsirt.org/vuln/ghsa-pw9m-5jxm-xr6h <p><strong>Affected:</strong> npm: better-auth</p> <p>### Am I affected?</p> <p>Users are affected if all of the following are true:</p> <p>- Their application uses `better-auth` and has enabled at least one of: `oidcProvider()` (imported from `better-auth/plugins/oidc-provider`), or `mcp()` (imported from `better-auth/plugins/mcp`). - Their application has at least one confidential OAuth client registered (any client with `type: &#34;web&#34; | &#34;native&#34; | &#34;user-agent-based&#34;` in the `oauthApplication` table, or any `trustedClients` entry without `type: &#34;public&#34;`). Public clients with PKCE are not affected. - Their application uses `better-auth` at a version below the patched release.</p> <p>If an application only uses `@better-auth/oauth-provider` (the canonical replacement for `oidc-provider`) and the `mcp` plugin is not enabled, it is not affected.</p> <p>Fix:</p> <p>1. Upgrade to `better-auth@1.6.11` or later. 2. Migrate from the deprecated `oidcProvider()` to `@better-auth/oauth-provider` when feasible. The new package enforces client authentication on both grants by default. 3. If developers cannot upgrade their applications, see workarounds below.</p> <p>### Summary</p> <p>The legacy `oidcProvider` and `mcp` plugins each expose an OAuth 2.0 token endpoint whose `refresh_token` grant authenticates the request entirely on possession of the bound `refreshToken` row and a matching `client_id`. Neither plugin verifies the registered confidential client&#39;s `client_secret` on the refresh path. An attacker who obtains any valid `refresh_token` (via database read, log capture, bro…</p> <p><strong>Affected:</strong> npm: better-auth</p> <p>### Am I affected?</p> <p>Users are affected if all of the following are true:</p> <p>- Their application uses `better-auth` and has enabled at least one of: `oidcProvider()` (imported from `better-auth/plugins/oidc-provider`), or `mcp()` (imported from `better-auth/plugins/mcp`). - Their application has at least one confidential OAuth client registered (any client with `type: &#34;web&#34; | &#34;native&#34; | &#34;user-agent-based&#34;` in the `oauthApplication` table, or any `trustedClients` entry without `type: &#34;public&#34;`). Public clients with PKCE are not affected. - Their application uses `better-auth` at a version below the patched release.</p> <p>If an application only uses `@better-auth/oauth-provider` (the canonical replacement for `oidc-provider`) and the `mcp` plugin is not enabled, it is not affected.</p> <p>Fix:</p> <p>1. Upgrade to `better-auth@1.6.11` or later. 2. Migrate from the deprecated `oidcProvider()` to `@better-auth/oauth-provider` when feasible. The new package enforces client authentication on both grants by default. 3. If developers cannot upgrade their applications, see workarounds below.</p> <p>### Summary</p> <p>The legacy `oidcProvider` and `mcp` plugins each expose an OAuth 2.0 token endpoint whose `refresh_token` grant authenticates the request entirely on possession of the bound `refreshToken` row and a matching `client_id`. Neither plugin verifies the registered confidential client&#39;s `client_secret` on the refresh path. An attacker who obtains any valid `refresh_token` (via database read, log capture, bro…</p> https://cve.radiocsirt.org/vuln/ghsa-pw9m-5jxm-xr6h