better-auth OAuth Refresh Token Rotation Concurrency Flaw (CVE-2026-55517)

Vulnerability Overview Title: OAuth refresh-token rotation forks the token family on concurrent redemption Description: This vulnerability involves the OAuth refresh token rotation mechanism in the package. Concurrent requests using the same refresh token can cause the token family to fork, potentially allowing attackers to bypass token revocation mechanisms and gain unauthorized access to user accounts. Affected Versions Affected Versions: - : >= 1.6.0, = 1.4.8-beta.7, < 1.6.0 Conditions for Impact: - The project depends on the above versions of or uses its embedded plugin. - At least one OAuth client requests the scope, resulting in the issuance of refresh tokens. - The same refresh token is accessed concurrently (e.g., an SPA sharing refresh tokens across multiple browser tabs, or mobile clients retrying after brief failures). Remediation Version Upgrade: - Upgrade to or later. - If upgrading is not feasible, refer to the workaround solutions below. Workaround Solutions 1. Adapter Level: Configure the database adapter to execute the OAuth refresh token handler under serialized isolation, or wrap to utilize row-level pessimistic locking. 2. Token Lifecycle: Set a shorter token expiration time via to reduce the attack window. 3. Client-Side Serialization: Use a mutex in the client SDK to serialize refresh token usage, preventing concurrent access. 4. Disable Refresh Tokens: Avoid requesting the scope. This closes the attack surface but will break long-lived sessions. Code Snippets No Proof of Concept (PoC) code or exploit code is provided. Additional Information CVSS Score: 8.1 / 10 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE ID: CVE-2026-55517 Weaknesses: - CWE-204 - CWE-362 - CWE-367 - CWE-613 References RFC 6749 §5.1: Refreshing an Access Token RFC 6749 §6.1: Refresh Token Rotation

Goal Reached Thanks to every supporter — we hit 100%!

better-auth OAuth Refresh Token Rotation Concurrency Flaw (CVE-2026-55517)

More from this source