Threats tagged 'ghsa-7w99-5wm4-3g79'

A race condition in @better-auth/oauth-provider versions >=1.6.0 and <1.6.11 allows concurrent redemption of the same OAuth authorization code. This occurs because the token endpoint uses a non-atomic find-then-delete operation to consume single-use authorization codes, enabling multiple token sets to be issued from one code. The issue also affects legacy plugins in better-auth versions >=1.4.8-beta.7 and <1.6.0. The vulnerability violates RFC 6749's single-use code requirement and can lead to multiple valid tokens from a single authorization code.