CVE-2026-53518

Katalog CVE

CVSS 8.1 · High EPSS 0,41%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada better-auth/oauth-provider, better-auth better auth. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g79 mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/b4bc65a007784b2eb0efb459e5fa6fd8055d3ec9 patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11 release notes