Race condition in the `@better-auth/oauth-provider` package (CVE-2026-53518)

CVE-2026-53518 is a race condition vulnerability in the `@better-auth/oauth-provider` package and related `better-auth` plugin paths whereby two concurrent POST requests to the OAuth authorization code token endpoint can both redeem the same single-use authorization code before either deletion completes, each minting independent sets of access tokens, refresh tokens, and id tokens. This violates RFC 6749 §4.1.2's single-use requirement for authorization codes and allows an attacker or racing client to obtain multiple valid token sets from a single authorization grant. Affected versions: - @better-auth/oauth-provider >= 1.6.0, < 1.6.11 - legacy oidc-provider and mcp plugins from better-auth/plugins We recommend updating to: @better-auth/oauth-provider 1.6.11, better-auth 1.6.11. CVSS 7.6 · our assessment: this_week Vendor advisory: https://github.com/better-auth/better-auth/security/advisories/GHSA-7w99-5wm4-3g79 Details: https://vuln.today/cve/CVE-2026-53518