better-auth npm Package Vulnerability: OAuth Refresh Token Issue
The better-auth npm package reportedly has a vulnerability where the oidcProvider and mcp plugins do not verify the client_secret on the refresh path, potentially allowing attackers to mint fresh access tokens. This appears to affect applications using these plugins with confidential OAuth clients.
What happened
An early warning has been issued regarding a vulnerability in the better-auth npm package. The issue reportedly lies in the oidcProvider and mcp plugins, which do not verify the client_secret during the refresh token process. This vulnerability could allow attackers to mint fresh access tokens, impacting applications that use these plugins with confidential OAuth clients.
The vulnerability is under investigation and has been tracked under the ID GHSA-PW9M-5JXM-XR6H. It is recommended that users upgrade to better-auth@1.6.11 or later to mitigate the risk. Additionally, migrating from oidcProvider to @better-auth/oauth-provider is advised when feasible.
For more detailed information, consult the primary source at [GHSA-pw9m-5jxm-xr6h](https://github.com/advisories/GHSA-pw9m-5jxm-xr6h). If further details are required, the primary sources should be referenced directly.
How 0Day mitigates this
better-auth is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.