CVE WatchJul 15, 2026

CVE-2026-53517

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider P

CVSS

8.1

High

EPSS

0.4%

p33

KEV

—

Exploit Today

0-100

Published: Jul 15, 2026 · Last modified: Jul 15, 2026 · CWE-362 · CWE-367

EPSS · 30d

Not enough EPSS history yet.

Technical description

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-250908.1 HIG

95.4%

——29Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.8d CVE-2026-506677.8 HIG

80.1%

——24Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.19h CVE-2026-59477.5 HIG

69.1%

——21Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.2d CVE-2026-561889.8 CRI

58.8%

——18Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.2d CVE-2026-503698.8 HIG

47.1%

——14Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.1d CVE-2026-566495.9 MED

46.6%

——14Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.2d