Threats Tagged 'ghsa-7w99-5wm4-3g79'
View all threats tagged with 'ghsa-7w99-5wm4-3g79'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-7w99-5wm4-3g79'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-7w99-5wm4-3g79: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitiveCVE-2026-53518 0 A race condition in @better-auth/oauth-provider versions >=1.6.0 and <1.6.11 allows concurrent redemption of the same OAuth authorization code. This occurs because the token endpoint uses a non-atomic find-then-delete operation to consume single-use authorization codes, enabling multiple token sets to be issued from one code. The issue also affects legacy plugins in better-auth versions >=1.4.8-beta.7 and <1.6.0. The vulnerability violates RFC 6749's single-use code requirement and can lead to multiple valid tokens from a single authorization code. Join the discussion | GCVE Database | 07/07/2026, 20:56:35 UTC Added: 07/08/2026, 13:21:59 UTC |
Showing 1 to 1 of 1 result