The vulnerability in better-auth oauth-provider versions prior to 1.7.0-beta.4 stems from a failure to bind the access-token audience to the authorization grant. As a result, an attacker who completes an OAuth flow can obtain access tokens with audiences targeting resource servers outside the scope of the original authorization. This improper authorization can lead to unauthorized access to resources that should be protected by OAuth authorization boundaries.

Attackers can obtain access tokens that grant access to resource servers not covered by the original authorization grant. This bypasses intended authorization restrictions and could lead to unauthorized access to protected resources. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor the vendor's announcements for updates and consider restricting OAuth client permissions and scopes as a temporary measure until a fix is available.