CVE-2026-53518

🗓️ 15 Jul 2026 17:17:06Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 WEB

Better Auth OAuth provider race in authorization code exchange enables multi-use code redemption; fixed in 1.6.11.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-53518	15 Jul 202617:17	–	attackerkb
Circl	CVE-2026-53518	7 Jul 202621:48	–	circl
Cvelist	CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption	15 Jul 202617:17	–	cvelist
EUVD	EUVD-2026-44734	15 Jul 202617:17	–	euvd
Github Security Blog	@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive	7 Jul 202620:56	–	github
NVD	CVE-2026-53518	15 Jul 202618:16	–	nvd
OSV	GHSA-7W99-5WM4-3G79 @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive	7 Jul 202620:56	–	osv
Patchstack	NPM: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive	7 Jul 202620:56	–	patchstack
Positive Technologies	PT-2026-56302	7 Jul 202600:00	–	ptsecurity
Snyk	Time-of-check Time-of-use (TOCTOU) Race Condition	7 Jul 202620:56	–	snyk

NVD

Vulners

Node

better-auth better-auth/oauth-providerRange1.6.0–1.6.11node.js

better-auth better_authRange1.6.0–1.6.11node.js

[
  {
    "vendor": "better-auth",
    "product": "better-auth",
    "versions": [
      {
        "version": ">= 1.6.0, < 1.6.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9
github	www.github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g79
github	www.github.com/better-auth/better-auth/releases/tag/v1.6.11

Parameter	Position	Path	Description	CWE
code	request body	/oauth2/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens.	CWE-367, CWE-362
grant_type	request body	/oauth2/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens.	CWE-367, CWE-362
redirect_uri	request body	/oauth2/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens.	CWE-367, CWE-362
client_id	request body	/oauth2/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens.	CWE-367, CWE-362
code	request body	/mcp/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens (legacy path).	CWE-367, CWE-362
grant_type	request body	/mcp/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens (legacy path).	CWE-367, CWE-362
redirect_uri	request body	/mcp/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens (legacy path).	CWE-367, CWE-362
client_id	request body	/mcp/token	Non-atomic find-then-delete during authorization_code grant allows concurrent requests to mint tokens (legacy path).	CWE-367, CWE-362

21 Jul 2026 16:03Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.1

CVSS 47.6

EPSS0.00229

SSVC