8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53517

CVE-2026-53517: Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53517

CVE-2026-53517:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@better-auth/oauth-provider	npm	>= 1.6.0, < 1.6.11	1.6.11
better-auth	npm	>= 1.4.8-beta.7, < 1.6.0	1.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition in the refresh token rotation and revocation process within the @better-auth/oauth-provider package. The root cause is a time-of-check to time-of-use (TOCTOU) flaw where the application checks if a refresh token is revoked and then proceeds to use it without any locking mechanism. This allows two concurrent requests with the same refresh token to both pass the revocation check before either one can mark the token as revoked, resulting in the issuance of multiple new refresh tokens (a "forked family").

The analysis of the patch commit c6918ecc9e3a75892169415d7f6c95b591b6a52d clearly shows the vulnerable functions and the fix. The functions createRefreshToken and revokeRefreshToken were modified to use an atomic compare-and-swap (CAS) operation. This is achieved by adding revoked: null to the where clause of the update operation, ensuring that the update only succeeds if the token has not been revoked by another process in the meantime. The handleRefreshTokenGrant function, which is the entry point for the refresh token grant, was also updated to use the new invalidateRefreshFamily function to clean up tokens when a replay is detected.

Therefore, the vulnerable functions that would appear in a runtime profile during exploitation are handleRefreshTokenGrant, createRefreshToken, and revokeRefreshToken.

Vulnerable functions

handleRefreshTokenGrant

packages/oauth-provider/src/token.ts

This function is the entry point for the refresh token grant flow. It was vulnerable because it called other functions with non-atomic operations, leading to a race condition. The patch modifies this function to call `invalidateRefreshFamily` when a revoked token is used, which is part of the fix to invalidate the entire token family.

createRefreshToken

packages/oauth-provider/src/token.ts

This function was vulnerable because it performed a non-atomic update to revoke the old refresh token. An attacker could send two concurrent requests with the same refresh token, and both would pass the revocation check before the token was marked as revoked. The patch fixes this by using a compare-and-swap (CAS) operation, ensuring that only one request can successfully rotate the token.

revokeRefreshToken

packages/oauth-provider/src/revoke.ts

Similar to `createRefreshToken`, this function was vulnerable due to a non-atomic update when revoking a refresh token. This allowed for a race condition where a token could be used after it was supposed to be revoked. The patch introduces a compare-and-swap (CAS) operation to make the revocation atomic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.