CVE-2026-53517

CVE-2026-53517 affects Better Auth’s oauth-provider (and related memory adapter) prior to version 1.6.11. The POST /oauth2/token refresh_token flow performs a non-atomic read–validate–revoke–mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh toke...

CVE-2026-53517 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refreshtoken grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing...

CVE-2026-53517 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refreshtoken grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing...

CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...

CVE-2026-53518

CVE-2026-53518 affects the Better Auth ecosystem, specifically the @better-auth/oauth-provider token endpoint for the authorization_code grant (and legacy paths via oidc-provider/mcp plugins). A race condition arises from a non-atomic find-then-delete when redeeming a single-use authorization cod...

Concurrent Execution Using Shared Resource

github.com/spectolabs/hoverfly is vulnerable to Concurrent Execution using Shared Resource. The vulnerability is due to the AddDiff function writing to the shared responsesDiff map without proper synchronization when running in Diff mode, which allows an attacker to send multiple simultaneous...

PT-2026-60329

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variables. Consequently, multiple Capture objects running within the same Python process could share state, including HTTP headers, cookies, browser storage, HTTP...

CVE-2026-53518: Concurrent Execution using Shared Resource with Improper Synchronization

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...

EUVD-2026-44124

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows NTFS allows an authorized attacker to elevate privileges locally...

EUVD-2026-44126

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...

EUVD-2026-44131

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Media allows an authorized attacker to elevate privileges locally...

EUVD-2026-43880

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

EUVD-2026-43833

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Kernel allows an authorized attacker to elevate privileges locally...

EUVD-2026-43800

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...

EUVD-2026-43970

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-50676

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Media allows an authorized attacker to elevate privileges locally...

Missing Synchronization

Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...

GHSA-QRH4-P6V4-MRFG Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...

EUVD-2026-44309

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Wireless Networking allows an authorized attacker to elevate privileges locally...

Windows App Package Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Installer allows an authorized attacker to elevate privileges locally...