Threats Tagged 'cve-2026-53512'
View all threats tagged with 'cve-2026-53512'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-53512'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-pw9m-5jxm-xr6h: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsCVE-2026-53512 0 A critical vulnerability in the legacy better-auth oidcProvider and mcp plugins allows OAuth refresh-token replay due to missing client authentication on the refresh_token grant. Confidential OAuth clients are not required to provide client_secret when refreshing tokens, enabling an attacker with a valid refresh_token and client_id to mint new access and refresh tokens indefinitely until revoked or expired. The issue is fixed in better-auth version 1.6.11 by enforcing client_secret verification on refresh_token grants and narrowing CORS policies. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication correctly. Workarounds include forcing all clients to public with PKCE, network ingress restrictions, and manual token revocation, but these do not fully mitigate the risk without patching. Join the discussion | GCVE Database | 07/07/2026, 20:11:50 UTC Added: 07/08/2026, 13:22:01 UTC |
Showing 1 to 1 of 1 result