CVE-2026-53512: Better-Auth Better Auth

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.

Affected products

• Better-Auth Better Auth: before 1.6.11 (fixed in 1.6.11)

Published 2026-07-15. Last modified 2026-07-21.