@better-auth/oauth-provider: Access Token Resource Indicator Not Bound to Authorization Grant (CWE-285)

Vulnerability Overview Title: @better-auth/oauth-provider: access-token audience (resource) not bound to the authorization grant (RFC 8707) Description: This vulnerability affects the package, where the audience (resource) of the access token is not bound to the authorization grant (RFC 8707). This allows an attacker to complete the OAuth flow and obtain an access token whose target points to a resource server whose authorization was not covered. When a resource server enforces the or value as the authorization scope, a token for one resource can be used by another resource. Affected Versions Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: None Remediation 1. Upgrade: Upgrade to (or higher), then run the schema migration ( ). 2. Workarounds: If upgrading is not possible, consider the following measures: - Set to a single audience, or leave it empty to use the default base URL. - Configure each resource server to accept tokens only when is its own identifier, and reject tokens where is an array containing other audiences. - Do not rely on the indicator as an authorization boundary until the fixed version is released. Detailed Information Issue Description: The provider accepts only at the token endpoint, not at the authorization endpoint. In , it validates the requested resource against the server-side whitelist and writes the result to the JWT claim. It does not record the requested resource on the authorization code, nor does it store them on refresh tokens. Impact: - For authorization code grants, the client discards the resource at and checks the resource at solely based on the whitelist. - For refresh tokens, the audience is inherited from the refresh token body because there is no resource from the original grant to restrict it. Fix: Fixed in (and later versions) by storing the requested resource during authorization, scoping at the token endpoint, preserving the original resource set across refreshes, and exposing in introspection. References RFC 8707: "Resource Indicators for OAuth 2.0" RFC 9068: "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens" CWE-863: "Improper Authorization" CWE-285: "Improper Authorization" Reporter Reporter: @dvanmali Fixer: @dvanmali Additional Information CVE ID: Unknown Weaknesses: CWE-285, CWE-863 --- The above is a summary of key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

@better-auth/oauth-provider: Access Token Resource Indicator Not Bound to Authorization Grant (CWE-285)

More from this source