CVE-2026-53518: Better Auth Authorization Bypass Vulnerability

CVE-2026-53518 Overview

CVE-2026-53518 is a race condition vulnerability in Better Auth, an authentication and authorization library for TypeScript. The flaw exists in the @better-auth/oauth-provider package from version 1.6.0 through 1.6.10. The POST /oauth2/token endpoint redeems single-use authorization codes through a non-atomic find-then-delete sequence. Two concurrent requests can pass the read step before either deletion completes, producing independent access tokens, refresh tokens, and ID tokens from a single authorization code. The legacy /oauth2/token and /mcp/token paths in the oidc-provider and mcp plugins share the same vulnerable primitive. The issue is tracked as [CWE-362] and fixed in version 1.6.11.

Critical Impact
A single authorization code can be redeemed multiple times through concurrent requests, allowing attackers to mint duplicate OAuth tokens and bypass single-use enforcement mandated by RFC 6749 §4.1.2.

Affected Products

Better Auth @better-auth/oauth-provider versions 1.6.0 through 1.6.10
Better Auth oidc-provider plugin (legacy /oauth2/token path) in the same version range
Better Auth mcp plugin (legacy /mcp/token path) in the same version range

Discovery Timeline

2026-07-15 - CVE-2026-53518 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-53518

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in the OAuth 2.0 authorization code grant flow. When a client submits an authorization code to POST /oauth2/token, the server calls findVerificationValue to look up the code, validates it, and then deletes it. Because the read and delete operations are not atomic, two parallel requests carrying the same authorization code can both succeed at the lookup step before either deletion is committed. Each request then proceeds to issue a fresh set of access, refresh, and ID tokens. This breaks the single-use invariant that OAuth 2.0 relies on to prevent token duplication and replay.

Root Cause

The root cause is the use of a non-atomic findVerificationValue followed by a separate delete in the token endpoint handlers of the oauth-provider, oidc-provider, and mcp plugins. The correct pattern, mandated by RFC 6749 §4.1.2, is a single atomic consume operation that both reads and removes the code in one database transaction.

Attack Vector

An attacker who obtains a valid authorization code, either through interception, a malicious client, or a compromised redirect URI, can submit two or more concurrent POST requests to the token endpoint. If the requests race the underlying database, each returns an independent, valid token bundle. The duplicated tokens can be used to maintain persistence, split sessions across attacker and victim, or bypass one-time-use security controls in downstream applications.

typescript

// Patch applied in packages/better-auth/src/plugins/oidc-provider/index.ts
// and packages/better-auth/src/plugins/mcp/index.ts

// Atomic single-use redemption per RFC 6749 §4.1.2. The first
// caller receives the row; concurrent racers receive `null`
// and fall through to the `invalid_grant` error path.
const verificationValue =
    await ctx.context.internalAdapter.consumeVerificationValue(
        code.toString(),
    );
if (!verificationValue) {
    // return invalid_grant
}

Source: Better Auth commit b4bc65a. The fix replaces the vulnerable findVerificationValue call with a new consumeVerificationValue primitive that performs an atomic read-and-delete.

Detection Methods for CVE-2026-53518

Indicators of Compromise

Multiple successful POST /oauth2/token responses returning distinct access tokens within milliseconds for the same code parameter value.
Duplicate token issuance events tied to a single authorization code in application audit logs.
Multiple refresh token records in the database that trace back to the same code or verification value identifier.
Concurrent requests to /oauth2/token or /mcp/token from the same client with identical code payloads and different session identifiers.

Detection Strategies

Instrument the token endpoint to log the authorization code (hashed) alongside the issued token identifier, then alert on any code that appears in more than one issuance event.
Add database-level uniqueness or transactional constraints on the verification value table so duplicate consumption attempts surface as constraint violations.
Review reverse proxy or load balancer logs for near-simultaneous requests to /oauth2/token, /mcp/token, or the OIDC token endpoint carrying identical bodies.

Monitoring Recommendations

Monitor OAuth token issuance volume per client and per user; sudden pairs of tokens issued for the same authorization code indicate exploitation.
Track the ratio of invalid_grant responses before and after upgrading; the atomic path should generate invalid_grant for losing racers.
Correlate authentication logs with downstream resource server logs to identify sessions that share an origin authorization code.

How to Mitigate CVE-2026-53518

Immediate Actions Required

Upgrade Better Auth and the @better-auth/oauth-provider, oidc-provider, and mcp plugins to version 1.6.11 or later.
Audit token issuance logs from the window when versions 1.6.0 through 1.6.10 were deployed for signs of duplicate code redemption.
Revoke access and refresh tokens issued during that window if duplication is suspected and force reauthentication.

Patch Information

The vulnerability is fixed in Better Auth 1.6.11. The patch, published in commit b4bc65a, replaces the non-atomic findVerificationValue plus delete pattern with a single consumeVerificationValue call that atomically reads and removes the authorization code. Concurrent callers that lose the race receive null and are routed to the invalid_grant error path. Refer to the GitHub Security Advisory GHSA-7w99-5wm4-3g79 and the v1.6.11 release notes for full details.

Workarounds

If upgrading immediately is not possible, place a request coalescing layer in front of the token endpoint that serializes requests carrying the same code value.
Enforce a database uniqueness constraint on the verification value primary key so duplicate consumption fails at the storage layer.
Reduce authorization code lifetime to the shortest value acceptable for your clients to shrink the exploitation window.

bash

# Upgrade Better Auth to the patched version
npm install better-auth@1.6.11

# Verify the installed version
npm ls better-auth