NPM · JULY 2026 · EARLY WARNING

OAuth Provider Refresh Token Issue: Assess Your Exposure Now

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
GHSA-392P-2Q2V-4372Severity: HIGH

An issue reportedly affects the OAuth provider's refresh token rotation, potentially leading to multiple tokens from a single parent. Users of @better-auth/oauth-provider and better-auth npm packages should assess their exposure.

What happened

An early warning has been issued regarding a vulnerability in the OAuth provider's refresh token rotation mechanism. This mechanism appears to fork the token family on concurrent redemption, which can result in multiple refresh tokens being minted from a single parent token. The affected components are @better-auth/oauth-provider (npm) versions >=1.6.0,<1.6.11 and better-auth (npm) versions >=1.4.8-beta.7,<1.6.0. It is under investigation whether this issue has been exploited.

To assess your exposure, check if your software utilizes the affected versions of @better-auth/oauth-provider or better-auth. If so, it is recommended to upgrade to @better-auth/oauth-provider@1.6.11 or later. If upgrading is not immediately possible, consider implementing the provided workarounds as a temporary measure.

For more detailed information and to follow the ongoing investigation, consult the primary source at [GHSA-392p-2q2v-4372](https://github.com/better-auth/better-auth/security/advisories/GHSA-392p-2q2v-4372). Stay updated with the latest developments to ensure your systems remain secure.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If @better-auth/oauth-provider is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats