CyberRota Analysis
AI-GeneratedThe vulnerability affects the Better Auth authentication and authorization library for TypeScript, specifically in versions prior to 1.6.11, where the legacy oidcProvider and mcp plugins improperly authenticate OAuth token endpoints. This flaw allows attackers with a valid refresh_token to generate access tokens and rotated refresh tokens without verifying the client_secret, potentially compromising sensitive user data. Organizations using affected versions of Better Auth should prioritize upgrading to version 1.6.11 to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens through /api/auth/oauth2/token or /api/auth/mcp/token. The @better-auth/oauth-provider package is not affected. This issue is fixed in version 1.6.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)