OAuth Provider Refresh Token Issue: Assess Your Exposure Now
An issue reportedly affects the OAuth provider's refresh token rotation, potentially leading to multiple tokens from a single parent. Users of @better-auth/oauth-provider and better-auth npm packages should assess their exposure.
What happened
An early warning has been issued regarding a vulnerability in the OAuth provider's refresh token rotation mechanism. This mechanism appears to fork the token family on concurrent redemption, which can result in multiple refresh tokens being minted from a single parent token. The affected components are @better-auth/oauth-provider (npm) versions >=1.6.0,<1.6.11 and better-auth (npm) versions >=1.4.8-beta.7,<1.6.0. It is under investigation whether this issue has been exploited.
To assess your exposure, check if your software utilizes the affected versions of @better-auth/oauth-provider or better-auth. If so, it is recommended to upgrade to @better-auth/oauth-provider@1.6.11 or later. If upgrading is not immediately possible, consider implementing the provided workarounds as a temporary measure.
For more detailed information and to follow the ongoing investigation, consult the primary source at [GHSA-392p-2q2v-4372](https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372). Stay updated with the latest developments to ensure your systems remain secure.
How 0Day mitigates this
@better-auth/oauth-provider is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.