CVE-2026-53512 Overview
CVE-2026-53512 is an authentication bypass vulnerability in Better Auth, a TypeScript authentication and authorization library. The flaw affects the legacy oidcProvider and mcp plugins in versions prior to 1.6.11. The OAuth refresh_token grant endpoints authenticate callers using only possession of a bound refreshToken row and a matching client_id, without verifying the confidential client's client_secret. An attacker holding a valid refresh token can mint new access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. The issue is resolved in version 1.6.11.
Critical Impact
Attackers with a stolen refresh token can bypass confidential client authentication to mint access tokens and rotate refresh tokens, enabling persistent unauthorized API access.
Affected Products
- Better Auth versions prior to 1.6.11 using the legacy oidcProvider plugin
- Better Auth versions prior to 1.6.11 using the mcp plugin
- TypeScript applications exposing /api/auth/oauth2/token or /api/auth/mcp/token endpoints
Discovery Timeline
- 2026-07-15 - CVE-2026-53512 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-53512
Vulnerability Analysis
The vulnerability is classified as improper authentication [CWE-287]. Better Auth's legacy oidcProvider and mcp plugins implement OAuth 2.0 token endpoints that handle the refresh_token grant type. The token endpoint validates the presented refresh token against the database and checks that the associated client_id matches the request. It does not, however, require or validate the confidential client's client_secret.
OAuth 2.0 defines confidential clients as clients capable of maintaining secrets. Section 6 of RFC 6749 requires the authorization server to authenticate the client when the client type is confidential. Better Auth's implementation skips this authentication step for the refresh grant, reducing the security model to bearer-token-only.
Root Cause
The root cause is missing client authentication logic in the refresh_token grant handler within the legacy oidcProvider and mcp plugins. The refresh grant path treats the refresh token itself as the sole authenticator, ignoring the client_secret credential that confidential clients are provisioned with. The @better-auth/oauth-provider package implements the correct check and is not affected.
Attack Vector
An attacker who obtains a valid refresh token — through log leakage, database compromise, client-side storage exposure, or interception — can submit a POST request to /api/auth/oauth2/token or /api/auth/mcp/token with grant_type=refresh_token, the stolen refresh_token, and the matching client_id. The server returns a new access token and rotates the refresh token, granting the attacker continued access without needing the confidential client's client_secret. Refresh token rotation compounds the impact by extending attacker persistence beyond the original token's lifetime.
No public proof-of-concept code is available at the time of publication. The vulnerability mechanics are documented in the GitHub Security Advisory GHSA-pw9m-5jxm-xr6h and the remediation pull request #9576.
Detection Methods for CVE-2026-53512
Indicators of Compromise
- Successful token responses from /api/auth/oauth2/token or /api/auth/mcp/token for requests missing a client_secret parameter or Authorization: Basic header.
- Refresh token rotations originating from source IP addresses or user agents that differ from the client's typical infrastructure.
- Access tokens issued for confidential clients where the accompanying authentication material cannot be correlated to stored client credentials.
Detection Strategies
- Enable request logging on Better Auth token endpoints and alert on grant_type=refresh_token calls that omit client authentication material.
- Correlate refresh token usage against expected client IP ranges and User-Agent fingerprints to surface anomalous callers.
- Review authentication audit logs for high-frequency refresh token exchanges or unusually long token lineage chains produced by repeated rotation.
Monitoring Recommendations
- Ingest Better Auth access logs into a centralized log platform and build detection rules for token endpoint anomalies.
- Monitor for geographic or ASN divergence between issuance and refresh of the same token family.
- Track the @better-auth/oauth-provider and better-auth package versions across build pipelines using software composition analysis.
How to Mitigate CVE-2026-53512
Immediate Actions Required
- Upgrade Better Auth to version 1.6.11 or later in all applications using the oidcProvider or mcp plugins.
- Invalidate and reissue all active refresh tokens issued by affected plugins to force reauthentication of confidential clients.
- Rotate any client_secret values that may have been exposed alongside compromised refresh tokens.
- Audit token endpoint logs for the presence of refresh grant calls without client authentication material during the vulnerable window.
Patch Information
The fix is included in Better Auth 1.6.11. The remediation adds client_secret verification to the refresh_token grant path in the legacy oidcProvider and mcp plugins. Details are available in the GitHub commit 1f2ff42, pull request #9576, and release notes for v1.6.11.
Workarounds
- Migrate to the @better-auth/oauth-provider package, which is not affected by this vulnerability.
- Place a reverse proxy or API gateway in front of /api/auth/oauth2/token and /api/auth/mcp/token that rejects refresh_token grant requests lacking a client_secret parameter or HTTP Basic authentication header.
- Shorten refresh token lifetimes and disable refresh token rotation to constrain the window of abuse until patching is complete.
# Upgrade Better Auth to the patched release
npm install better-auth@1.6.11
# Verify the installed version
npm ls better-auth
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
