https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:16:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338134 EUVD-2026-338134 https://cve.radiocsirt.org/vuln/euvd-2026-338134 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53517 <p>Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.</p> <p>Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53517 https://cve.radiocsirt.org/vuln/ghsa-392p-2q2v-4372 <p><strong>Affected:</strong> npm: @better-auth/oauth-provider, npm: better-auth</p> <p>### Am I affected?</p> <p>Users are affected if all of the following are true:</p> <p>- Their project depends on `@better-auth/oauth-provider` at a version `&gt;= 1.6.0, &lt; 1.6.11`, or uses the embedded plugin in `better-auth &gt;= 1.4.8-beta.7, &lt; 1.6.0`. - At least one OAuth client served by their application&#39;s authorization server requests the `offline_access` scope, so refresh tokens are minted. - Concurrent redemption of the same refresh token is reachable: an SPA shares one refresh token across browser tabs without a mutex, a mobile client retries after a transient failure, an attacker who has stolen a refresh token times two requests, or a service worker queues offline requests.</p> <p>If developer applications do not request `offline_access` for any client, no refresh tokens are minted and they are not exposed.</p> <p>Fix:</p> <p>1. Upgrade to `@better-auth/oauth-provider@1.6.11` or later. 2. If developers cannot upgrade, see workarounds below.</p> <p>### Summary</p> <p>The OAuth provider&#39;s `POST /oauth2/token` endpoint, on the `refresh_token` grant, performs a non-atomic read / validate / revoke / mint sequence on the `oauthRefreshToken` row. Two concurrent requests presenting the same parent refresh token both pass the revocation check before either revoke completes, so each mints a fresh refresh token. The replay-detection branch only fires when `revoked` is already truthy at read time, which is exactly the state concurrent attackers race past. The result is a forked refresh-token family from a single parent toke…</p> <p><strong>Affected:</strong> npm: @better-auth/oauth-provider, npm: better-auth</p> <p>### Am I affected?</p> <p>Users are affected if all of the following are true:</p> <p>- Their project depends on `@better-auth/oauth-provider` at a version `&gt;= 1.6.0, &lt; 1.6.11`, or uses the embedded plugin in `better-auth &gt;= 1.4.8-beta.7, &lt; 1.6.0`. - At least one OAuth client served by their application&#39;s authorization server requests the `offline_access` scope, so refresh tokens are minted. - Concurrent redemption of the same refresh token is reachable: an SPA shares one refresh token across browser tabs without a mutex, a mobile client retries after a transient failure, an attacker who has stolen a refresh token times two requests, or a service worker queues offline requests.</p> <p>If developer applications do not request `offline_access` for any client, no refresh tokens are minted and they are not exposed.</p> <p>Fix:</p> <p>1. Upgrade to `@better-auth/oauth-provider@1.6.11` or later. 2. If developers cannot upgrade, see workarounds below.</p> <p>### Summary</p> <p>The OAuth provider&#39;s `POST /oauth2/token` endpoint, on the `refresh_token` grant, performs a non-atomic read / validate / revoke / mint sequence on the `oauthRefreshToken` row. Two concurrent requests presenting the same parent refresh token both pass the revocation check before either revoke completes, so each mints a fresh refresh token. The replay-detection branch only fires when `revoked` is already truthy at read time, which is exactly the state concurrent attackers race past. The result is a forked refresh-token family from a single parent toke…</p> https://cve.radiocsirt.org/vuln/ghsa-392p-2q2v-4372