The OAuth provider's POST /oauth2/token endpoint for the authorization_code grant uses a non-atomic find-then-delete sequence to redeem single-use authorization codes. When two concurrent requests race, both can read the code before either deletes it, resulting in both requests successfully minting access, refresh, and ID tokens. This breaks the single-use guarantee mandated by RFC 6749 §4.1.2. The root cause is that the deletion primitive discards the row count, preventing detection of concurrent claims. The fix, introduced in version 1.6.11, replaces this with an atomic claimVerificationByIdentifier primitive that atomically claims and deletes the verification row, ensuring only the first request succeeds and others receive an invalid_grant error. Legacy plugins oidc-provider and mcp share this vulnerability and are fixed in better-auth 1.6.11. Workarounds at network, database, or application layers exist but do not fully resolve the issue without upgrading.

Multiple independent token sets (access, refresh, and ID tokens) can be issued from a single authorization code, violating the OAuth 2.0 specification's single-use code requirement. This allows bypassing detection mechanisms that rely on single redemption, potentially enabling token duplication and unauthorized token use within the original user's authorization scope. The vulnerability affects both the main OAuth provider and legacy plugins, increasing the attack surface for affected deployments.

An official fix is available by upgrading to @better-auth/oauth-provider version 1.6.11 or later. For legacy plugin users, upgrade better-auth to version 1.6.11 or later. No workaround fully closes the vulnerability without applying the patch. Temporary mitigations include deploying a reverse proxy that serializes token requests by authorization code, adding database uniqueness constraints on token issuance (if feasible), or implementing custom adapter hooks to detect duplicate claims; however, these are fragile and not recommended as sole solutions. Upgrading remains the only reliable remediation.