Better Auth is a TypeScript authentication and authorization library that, during the OAuth2 refresh_token grant, implements a non‑atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row. This race condition permits concurrent requests using the same parent refresh token to bypass the revocation check and create forked refresh‑token families. The result is the creation of multiple independent refresh token chains that an attacker can replay, leading to the unauthorized issuance of new access tokens for the same user session and compromising confidentiality. The flaw applies to the @better‑auth/oauth‑provider POST /oauth2/token endpoint in all releases from 1.4.8‑beta.7 through 1.6.11, and also affects embedded Better Auth plugin versions prior to 1.6.0; the issue is fixed in version 1.6.11.

Vulnerable products are the @better‑auth/oauth‑provider package and the core Better Auth library. Any instance running a version between 1.4.8‑beta.7 and 1.6.11, inclusive, as well as embedded Better Auth plugin versions before 1.6.0, is impacted. The vulnerability is exposed only at the OAuth token endpoint that handles the refresh_token grant.

The CVSS score of 8.1 indicates high severity, while the EPSS below 1% suggests a low public exploitation probability. The vulnerable endpoint can be triggered in parallel without privileged access, enabling an attacker to concurrently request token refreshes that evade revocation checks. Successful exploitation results in the generation of rogue refresh‑token families and the issuance of unauthorized access tokens, potentially compromising the confidentiality and integrity of protected resources.