PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53518 Better Auth CVE debrief

The Better Auth library for TypeScript, versions 1.6.0 through 1.6.10, contains a vulnerability in its OAuth2 token endpoint. Specifically, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant uses a non-atomic find-then-delete sequence to redeem single-use authorization codes. This allows two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens. The issue is fixed in version 1.6.11. This vulnerability has a high impact on developers and administrators using the Better Auth library for TypeScript, particularly those who have implemented OAuth2 functionality.

Vendor
Better Auth
Product
Better-Auth/oauth-Provider
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-15
Original CVE updated
2026-07-21
Advisory published
2026-07-15
Advisory updated
2026-07-21

Who should care

Developers and administrators using the Better Auth library for TypeScript, particularly those who have implemented OAuth2 functionality, should be aware of this vulnerability and take steps to update to version 1.6.11 or later. This vulnerability has a high impact on affected operators, platforms, and security teams.

Technical summary

The vulnerability in Better Auth's OAuth2 token endpoint arises from a non-atomic find-then-delete sequence used to redeem single-use authorization codes. This sequence allows for concurrent requests to bypass the intended single-use restriction, potentially leading to the issuance of unauthorized access tokens, refresh tokens, and ID tokens. The affected versions are 1.6.0 through 1.6.10, and the issue is resolved in version 1.6.11. The vulnerability has a CVSS score of 7.6 and a severity of HIGH.

Defensive priority

High

Recommended defensive actions

  • Update to version 1.6.11 or later
  • Review and monitor OAuth2 token endpoint usage
  • Implement additional security measures, such as token validation and revocation
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-15T18:16:48.240Z and was last modified on 2026-07-21T16:03:12.347Z. The NVD entry is currently Analyzed. The Better Auth library for TypeScript, versions 1.6.0 through 1.6.10, contains a vulnerability in its OAuth2 token endpoint. Specifically, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant uses a non-atomic find-then-delete sequence to redeem single-use authorization codes. This allows two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens. The issue is fixed in version 1.6.11. Evidence limits suggest that defenders verify affected product deployments and review official advisories for validation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-15T18:16:48.240Z and has not been modified since then. The NVD entry is currently Analyzed.