Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2026-53517 Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint… https://www.cve.org/CVERecord?id=CVE-2026-53517
Post summary
The post announces CVE-2026-53517 impacting the @better-auth/oauth-provider POST /oauth2/token endpoint in specific library versions, and shares a link to the CVE record for reference.
🚨*CVE* CVE-2026-53517 Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint… https://www.cve.org/CVERecord?id=CVE-2026-53517 ----- Traducción: CVE-2026-53517 Bet… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑53517 for Better Auth, providing a link to the CVE record but no exploitation details, PoC, or remediation guidance.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | better-auth | better-auth\/oauth-provider | - | node.js | - |
| App | better-auth | better_auth | - | node.js | - |
| App | better-auth | better_auth | 1.4.8 | node.js | - |
| App | better-auth | better_auth | 1.4.8 | node.js | - |