CVSS 4.0
9.1 criticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-53512
Critical (9.1) in better-auth better auth. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in better-auth 1.6.11.
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
Severity
CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-287, CWE-306, CWE-345, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- better-auth:better_auth
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pw9m-5jxm-xr6h | npm | better-auth | <1.6.11 | 1.6.11 |