Technical impact
This flaw, a CWE‑287: Improper Authentication, lies in the refresh_token grant of the legacy oidcProvider and mcp plugins of Better Auth. The server verifies only the existence of a bound refresh token and a matching client_id but fails to enforce the confidential client's client_secret. The likely attack vector is that an attacker who possesses a valid refresh token can send a request to the exposed /api/auth/oauth2/token or /api/auth/mcp/token endpoints without providing a client_secret, thereby obtaining new access tokens and rotated refresh tokens. This authentication bypass permits unauthorized token issuance, enabling an attacker to acquire credentials that could be used to access protected resources.
Affected Systems
This issue targets the Better Auth authentication library for TypeScript, specifically the legacy oidcProvider and mcp plugins in any release prior to version 1.6.11. The @better-auth/oauth-provider package is not affected. Systems that have installed the older plugins and expose the /api/auth/oauth2/token or /api/auth/mcp/token endpoints without requiring client_secret verification are at risk.
Risk and Exploitability
The CVSS score of 9.1 indicates high severity. The EPSS score of less than 1% suggests low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need a legitimate refresh token and then send a request to the token endpoint without providing a client_secret. Once the token is in hand, the exploit path is straightforward and requires no additional privileged access or complex preparation.
Github GHSA