CVE-2026-53517 better-auth CVE debrief

Who should care

Users of Better Auth OAuth Provider versions 1.4.8-beta.7 to 1.6.11 should be aware of this vulnerability and take necessary actions to protect their systems, including reviewing system configurations, validating oauthRefreshToken row sequences, and implementing compensating controls.

Technical summary

The @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row. This allows concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families. The vulnerable range includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11. Users should review and validate oauthRefreshToken row sequences and implement compensating controls.

Defensive priority

High

Recommended defensive actions

• Update to version 1.6.11 or later
• Review and validate oauthRefreshToken row sequences
• Implement compensating controls to prevent concurrent requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-15T18:16:48.107Z and was last modified on 2026-07-21T16:00:22.173Z. The NVD entry is currently Analyzed. The vulnerability affects Better Auth OAuth Provider versions 1.4.8-beta.7 to 1.6.11. Users should review and validate oauthRefreshToken row sequences and implement compensating controls to prevent concurrent requests. Evidence limits suggest verifying system configurations and reviewing compensating controls.

Official resources