EUVD-2026-51836
GHSA-hq9c-fvm2-pfh9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required OAuth client registration; S:C captures impact on resource servers outside the authorization server's trust boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
AnalysisAI
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Technical ContextAI
The affected package (cpe:2.3:a:better-auth:oauth-provider:*:*:*:*:*:*:*:*) implements an OAuth 2.0 authorization server for Node.js applications. RFC 8707 (Resource Indicators for OAuth 2.0) allows clients to specify target resource servers using the resource parameter, which the provider is expected to bind to the authorization code and later enforce at the token endpoint. CWE-285 (Improper Authorization) captures the root cause: the server validates each requested resource only against its server-wide validAudiences allowlist but does not persist the authorized resource set on the authorization code or refresh-token row. Consequently, the authorization grant never carries the scoped resource binding, and any allow-listed resource can be requested at /oauth2/token regardless of what was authorized. The same gap applies to the refresh grant, allowing a refresh token tied to one audience to yield an access token for a different allow-listed audience.
RemediationAI
Vendor-released patch: 1.7.0-beta.4. Upgrade @better-auth/oauth-provider to version 1.7.0-beta.4 (and subsequently 1.7.0 when released) and run the required schema migration via 'npx auth migrate'. This is a breaking change: after the upgrade, a token or refresh request may only narrow the authorized resource set; requests for a resource not covered by the original grant return an invalid_target error, and the customAccessTokenClaims callback receives a resources array instead of a scalar resource field. Operators who cannot migrate to the 1.7.0 pre-release line and must remain on the stable 1.6.x branch should consult the workarounds described in GHSA-p2fr-6hmx-4528. Organizations with a single validAudiences entry (the default) are not vulnerable to cross-audience escalation but still have the spec-compliance gap; upgrading is recommended regardless. The full advisory is at https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528 and additional context is available at https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today