Better Auth’s OAuth2 token exchange endpoint relies on a non‑atomic find‑then‑delete sequence when redeeming authorization codes. Two concurrent POST /oauth2/token requests for the same code can both detect it as present before it is removed, resulting in two independent sets of tokens (access, refresh, and ID). This enables the same authorization code to be reused, creating duplicate privileges, replay possibilities, and violating the designed single‑use policy. Additionally, legacy /oauth2/token and /mcp/token paths in the oidc‑provider and mcp plugins share this same primitive, expanding the risk surface.

The flaw exists in the Better Auth library for TypeScript, specifically from version 1.6.0 up to and including 1.6.11, affecting the @better-auth/oauth-provider POST /oauth2/token endpoint handling the authorization_code grant. Legacy /oauth2/token and /mcp/token paths in the oidc‑provider and mcp plugins use the same vulnerable logic. Upgrading to v1.6.11 or later removes the issue.

The CVSS score of 7.6 indicates a high severity vulnerability, while the EPSS score of less than 1% signals a low likelihood of active exploitation as of this analysis. The issue is not cataloged in CISA’s KEV, and no public exploits have been reported. Nevertheless, any client or attacker capable of inducing concurrent token exchanges—including in high‑traffic or network‑constrained environments—could abuse this race condition, potentially generating multiple valid token sets from a single authorization code.