CVE-2026-53512
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
How to fix
- better-auth better_auth1.6.11 or later
- better-auth1.6.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| better-auth better_auth | v < 1.6.11 | 1.6.11 |
| better-authnpm | v < 1.6.11 | 1.6.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.