Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (CVE-2026-53512)
A critical vulnerability in the legacy better-auth oidcProvider and mcp plugins allows OAuth refresh-token replay due to missing client authentication on the refresh_token grant. Confidential OAuth clients are not required to provide client_secret when refreshing tokens, enabling an attacker with a valid refresh_token and client_id to mint new access and refresh tokens indefinitely until revoked or expired. The issue is fixed in better-auth version 1.6.11 by enforcing client_secret verification on refresh_token grants and narrowing CORS policies. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication correctly. Workarounds include forcing all clients to public with PKCE, network ingress restrictions, and manual token revocation, but these do not fully mitigate the risk without patching.
AI Analysis
Technical Summary
The better-auth legacy oidcProvider and mcp plugins expose OAuth 2.0 token endpoints where the refresh_token grant does not verify the confidential client's client_secret, relying only on possession of the refresh_token and client_id. This violates RFC 6749 and OAuth 2.1 requirements for confidential client authentication on every grant. An attacker with any valid refresh_token and the public client_id can indefinitely mint fresh access and rotated refresh tokens until the token row is revoked or expires. The mcp plugin also had insecure CORS configuration allowing Access-Control-Allow-Origin: * which amplifies the risk in browser contexts. The vulnerability is fixed in [email protected] by requiring client_secret on refresh_token grants and correcting CORS settings. The newer @better-auth/oauth-provider package is not affected as it enforces client authentication properly. Workarounds exist but do not fully close the vulnerability without patching.
Potential Impact
An attacker who obtains any valid refresh_token and the public client_id for a confidential client can impersonate that client indefinitely by minting new access tokens and rotated refresh tokens. This allows unauthorized access to protected resources until the refresh token is revoked or expires. The vulnerability affects confidentiality and integrity of OAuth tokens but does not impact availability. The insecure CORS configuration in the mcp plugin increases risk in browser environments by enabling cross-origin token replay attacks.
Mitigation Recommendations
A fix is available in better-auth version 1.6.11 and later, which enforces client_secret verification on refresh_token grants for confidential clients and narrows CORS allowlists. Users should upgrade to [email protected] or later. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication by default and is not affected. If upgrading is not immediately possible, workarounds include forcing all clients to public with PKCE, restricting token endpoint access by IP at the network layer, manually revoking refresh tokens on suspicion of compromise, and tightening CORS policies on the mcp endpoint. However, these workarounds do not fully mitigate the vulnerability without applying the patch.
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (CVE-2026-53512)
Description
A critical vulnerability in the legacy better-auth oidcProvider and mcp plugins allows OAuth refresh-token replay due to missing client authentication on the refresh_token grant. Confidential OAuth clients are not required to provide client_secret when refreshing tokens, enabling an attacker with a valid refresh_token and client_id to mint new access and refresh tokens indefinitely until revoked or expired. The issue is fixed in better-auth version 1.6.11 by enforcing client_secret verification on refresh_token grants and narrowing CORS policies. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication correctly. Workarounds include forcing all clients to public with PKCE, network ingress restrictions, and manual token revocation, but these do not fully mitigate the risk without patching.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The better-auth legacy oidcProvider and mcp plugins expose OAuth 2.0 token endpoints where the refresh_token grant does not verify the confidential client's client_secret, relying only on possession of the refresh_token and client_id. This violates RFC 6749 and OAuth 2.1 requirements for confidential client authentication on every grant. An attacker with any valid refresh_token and the public client_id can indefinitely mint fresh access and rotated refresh tokens until the token row is revoked or expires. The mcp plugin also had insecure CORS configuration allowing Access-Control-Allow-Origin: * which amplifies the risk in browser contexts. The vulnerability is fixed in [email protected] by requiring client_secret on refresh_token grants and correcting CORS settings. The newer @better-auth/oauth-provider package is not affected as it enforces client authentication properly. Workarounds exist but do not fully close the vulnerability without patching.
Potential Impact
An attacker who obtains any valid refresh_token and the public client_id for a confidential client can impersonate that client indefinitely by minting new access tokens and rotated refresh tokens. This allows unauthorized access to protected resources until the refresh token is revoked or expires. The vulnerability affects confidentiality and integrity of OAuth tokens but does not impact availability. The insecure CORS configuration in the mcp plugin increases risk in browser environments by enabling cross-origin token replay attacks.
Mitigation Recommendations
A fix is available in better-auth version 1.6.11 and later, which enforces client_secret verification on refresh_token grants for confidential clients and narrows CORS allowlists. Users should upgrade to [email protected] or later. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication by default and is not affected. If upgrading is not immediately possible, workarounds include forcing all clients to public with PKCE, restricting token endpoint access by IP at the network layer, manually revoking refresh tokens on suspicion of compromise, and tightening CORS policies on the mcp endpoint. However, these workarounds do not fully mitigate the vulnerability without applying the patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pw9m-5jxm-xr6h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53512"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a4e4ef9c9d9e3dbe328cf2e
Added to database: 07/08/2026, 13:22:01 UTC
Last enriched: 07/08/2026, 13:45:48 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.