{"data":{"id":"1556daab-daa3-4009-b02a-7418bc0ec2fb","title":"GHSA-7w99-5wm4-3g79: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive","summary":"GHSA-7w99-5wm4-3g79 affects @better-auth/oauth-provider at versions >= 1.6.0 and < 1.6.11, the embedded plugin in better-auth >= 1.4.8-beta.7 and < 1.6.0, and the legacy oidc-provider and mcp plugins. The POST /oauth2/token authorization_code grant redeems single-use codes through a non-atomic find-then-delete sequence, so two concurrent requests with the same code can both pass verification and each mint access, refresh and id tokens, contrary to RFC 6749 section 4.1.2.","solution":"Fixed in @better-auth/oauth-provider@1.6.11 and better-auth@1.6.11 for the legacy oidc-provider and mcp plugin paths, which switch to an atomic internalAdapter.consumeVerificationValue claim. Upgrade is the recommended path; the source says the listed workarounds (reverse-proxy serialization, database uniqueness constraints, application-layer hooks) do not fully close the bug without a code patch.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7w99-5wm4-3g79","publishedAt":"2026-07-07T20:56:35.000Z","cveId":"CVE-2026-53518","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["better-auth@< 1.6.11 (fixed: 1.6.11)","@better-auth/oauth-provider@>= 1.6.0, < 1.6.11 (fixed: 1.6.11)"],"affectedPackageNames":["better-auth","@better-auth/oauth-provider"],"affectedPackageRefs":["npm:@better-auth/oauth-provider","npm:better-auth"],"affectedVendors":[],"affectedVendorsRaw":["@better-auth/oauth-provider","better-auth","Claude Desktop"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00409,"epssCheckedAt":"2026-10-14T18:06:00.235Z","kevDateAdded":null,"advisoryAliases":["GHSA-7w99-5wm4-3g79"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-07T20:56:35.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null}}