CVE-2026-53512
Better Auth is an authentication and authorization library for TypeScript. Versions before 1.6.11 expose OAuth token endpoints that let anyone with a valid refresh token create new access tokens without needing the client secret. This flaw can allow attackers to hijack user sessions.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Developers using the Better Auth library for TypeScript, specifically versions prior to 1.6.11 that employ the legacy oidcProvider or mcp plugins.
Real-world impact
An attacker who obtains a refresh token can generate new access tokens and rotated refresh tokens, effectively taking over the user’s account and continuing to act as the user without further authentication.
Why this severity
The CVSS score of 9.1 reflects the high confidentiality and integrity impact of the vulnerability, combined with the fact that no authentication is required to exploit it. An attacker can fully compromise user sessions by simply possessing a refresh token.
What to do about it
- 01Upgrade the Better Auth library to version 1.6.11 or later.
NVD-referenced vendor advisory
Timeline
- Jul 15, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 21, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/better-auth/better-auth/com…patch
- github.com/better-auth/better-auth/pul…issue trackingpatch
- github.com/better-auth/better-auth/rel…release notes
- github.com/better-auth/better-auth/sec…mitigationvendor advisory