GHSA-7w99-5wm4-3g79: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

Summary

GHSA-7w99-5wm4-3g79 affects @better-auth/oauth-provider at versions >= 1.6.0 and < 1.6.11, the embedded plugin in better-auth >= 1.4.8-beta.7 and < 1.6.0, and the legacy oidc-provider and mcp plugins. The POST /oauth2/token authorization_code grant redeems single-use codes through a non-atomic find-then-delete sequence, so two concurrent requests with the same code can both pass verification and each mint access, refresh and id tokens, contrary to RFC 6749 section 4.1.2.

Mitigation

Fixed in @better-auth/oauth-provider@1.6.11 and better-auth@1.6.11 for the legacy oidc-provider and mcp plugin paths, which switch to an atomic internalAdapter.consumeVerificationValue claim. Upgrade is the recommended path; the source says the listed workarounds (reverse-proxy serialization, database uniqueness constraints, application-layer hooks) do not fully close the bug without a code patch.

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database