CVE-2026-50518: Race Condition in @better-auth OAuth Token Redemption

Vulnerability Overview Vulnerability Name: @better-auth/oauth-provider: OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive CVE ID: CVE-2026-50518 Severity: High (8.1 / 10) Publication Date: May 31, 2024 Reporter: @chdanielmueller Scope Affected Versions: @better-auth/oauth-provider >= 1.6.0, = 1.6.0, < 1.6.11, or uses the embedded plugin within better-auth. - The endpoint (or and for legacy plugins) is exposed as an OAuth/OIDC client. - No external mitigations are implemented, such as load-balancer-based deduplication caching, database triggers rejecting duplicate token issuers, or custom adapter overrides that perform atomic compare-and-delete operations. Remediation Direct Fix: - Upgrade to @better-auth/oauth-provider 1.6.11 or later. If using the legacy plugin path, upgrade to better-auth 1.6.11 or later. Workarounds: - Network Layer: Deploy an authorization-server-aware reverse proxy (e.g., Envoy, NGINX with Lua, custom Cloudflare Worker) that maintains an internal registry, keys by the parameter, and serializes concurrent requests. - Database Layer: Add SQL or Mongo uniqueness constraints to prevent the creation of two rows referencing the same upstream code. - Application Layer: Wrap 's with a custom hook, using with a surface count, and inject an rejection when the count reaches zero. Details Vulnerability Description: The OAuth provider's endpoint in the grant redeems single-use authorization codes via a find-then-delete primitive. Two concurrent requests using the same value both pass the read step and complete before the delete step, subsequently passing PKCE validation and . Each surviving request receives a new access token, refresh token, and ID token. RFC 6749 §4.1.2 mandates that authorization codes be single-use; this primitive does not enforce concurrency safety. Fix Details: The fix introduces a primitive that performs an atomic claim and return operation at the internal adapter layer, replacing the find-then-delete primitive at this call site and migrating the highest-impact variant instances. Patch: The legacy and plugin paths were fixed in @better-auth/oauth-provider@1.6.11 and better-auth@1.6.11. All three token exchange call sites now consume the verification row via , which is an atomic claim primitive that deletes the row and returns its truthy value. The first request succeeds, while the second request receives an invalid authorization code. Concurrent competitors observe an empty result and return . Error Code Consistency: The branch on the @better-auth/oauth-provider token endpoint previously returned a project-specific , which is part of the RFC 6749 §5.2 response error set. Both branches now return , allowing specification-compliant clients to branch to the standard code without special cases. Impact Multiple Independent Token Sets: Access tokens, refresh tokens, and ID tokens derived from a single authorization are valid for the original user's granted scopes. Detection Bypass: Standard OAuth single-use enforcement does not apply when the two requests interleave. Legacy Plugin Reachability: The and plugins share the same primitive, so deployments using them inherit the same impact. References CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE-294: Authentication Bypass by Capture-replay RFC 6749 §4.1.2: Authorization Request OAuth 2.1 §4.1: Authorization Code Grant

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-50518: Race Condition in @better-auth OAuth Token Redemption

More from this source