CyberRota Analysis
AI-GeneratedThe Better Auth library for TypeScript versions 1.6.0 to 1.6.11 is vulnerable due to a non-atomic operation in the POST /oauth2/token endpoint, which allows concurrent requests to exploit a race condition and generate multiple valid access tokens from a single authorization code. This vulnerability poses a significant risk of unauthorized access, as it can lead to the issuance of independent access, refresh, and ID tokens. Organizations utilizing this library should prioritize upgrading to version 1.6.11 to mitigate the risk of token abuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)