Threats tagged 'ghsa-pw9m-5jxm-xr6h'

A critical vulnerability in the legacy better-auth oidcProvider and mcp plugins allows OAuth refresh-token replay due to missing client authentication on the refresh_token grant. Confidential OAuth clients are not required to provide client_secret when refreshing tokens, enabling an attacker with a valid refresh_token and client_id to mint new access and refresh tokens indefinitely until revoked or expired. The issue is fixed in better-auth version 1.6.11 by enforcing client_secret verification on refresh_token grants and narrowing CORS policies. Migration to the newer @better-auth/oauth-provider package is recommended as it enforces client authentication correctly. Workarounds include forcing all clients to public with PKCE, network ingress restrictions, and manual token revocation, but these do not fully mitigate the risk without patching.