CVE-2026-53512: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
(updated )
The legacy oidcProvider and mcp plugins each expose an OAuth 2.0 token endpoint whose refresh_token grant authenticates the request entirely on possession of the bound refreshToken row and a matching client_id. Neither plugin verifies the registered confidential client’s client_secret on the refresh path. An attacker who obtains any valid refresh_token (via database read, log capture, browser-side XSS, or CORS-amplified script in the mcp case) and the public client_id can mint fresh access tokens and rotated refresh tokens until the chain is revoked.
References
- github.com/advisories/GHSA-pw9m-5jxm-xr6h
- github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c
- github.com/better-auth/better-auth/pull/9576
- github.com/better-auth/better-auth/releases/tag/v1.6.11
- github.com/better-auth/better-auth/security/advisories/GHSA-pw9m-5jxm-xr6h
- nvd.nist.gov/vuln/detail/CVE-2026-53512
Code Behaviors & Features
Detect and mitigate CVE-2026-53512 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →