CVE-2026-53512

Katalog CVE

CVSS 9.1 · Critical EPSS 0,27%

Kerentanan Improper Authentication pada better-auth better auth. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function
CWE-345: Insufficient Verification of Data Authenticity
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-pw9m-5jxm-xr6h mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/1f2ff4215c4affff0b140b0c0a712c0dde35659c patch
• https://github.com/better-auth/better-auth/pull/9576 issue tracking · patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes