The OAuth provider's refresh token rotation endpoint performs a non-atomic sequence of read, validate, revoke, and mint operations on the refresh token record. When two concurrent requests redeem the same refresh token, both pass the revocation check before either revokes the token, resulting in both minting new refresh tokens and thus forking the token family. The root cause is that the update predicate does not include a 'revoked IS NULL' condition, allowing concurrent updates to succeed without error. The schema also lacks a unique constraint on refresh tokens, permitting concurrent token creation without collision. The fix in @better-auth/[email protected] adds an atomic compare-and-swap update with a rowcount check to ensure only one request succeeds, returning 'invalid_grant' to the loser. This prevents token family forks and enforces proper refresh token rotation per RFC 9700 §4.14. The patch also includes a unique constraint on the refresh token field and compatibility fixes for the in-memory adapter. No full strict family invalidation is implemented yet but planned for a future release.

The vulnerability allows an attacker or client to redeem the same refresh token concurrently, resulting in multiple valid refresh tokens (a forked token family). This undermines the security guarantees of refresh token rotation, potentially allowing indefinite access token renewal with a stolen or reused refresh token until it expires or is revoked. This increases the risk of unauthorized long-term access to protected resources. However, the issue only affects applications using the affected versions and requesting the 'offline_access' scope to mint refresh tokens.

Upgrade to @better-auth/oauth-provider version 1.6.11 or later, which includes an atomic compare-and-swap fix for refresh token rotation and adds a unique constraint on refresh tokens. If upgrading is not immediately possible, no full workaround closes the vulnerability; developers should avoid concurrent refresh token redemption scenarios (e.g., avoid sharing refresh tokens across browser tabs without mutexes or retrying refresh token requests concurrently). Monitor vendor advisories for further updates on strict family invalidation. The patch is available and should be applied promptly.