The vulnerability allows an attacker to request an OAuth access token for any audience, regardless of the authorization grant originally issued. As a result, a malicious client can obtain tokens that target protected resource servers the user never approved, effectively bypassing the intended scope of access. This creates an Authorization Bypass scenario, permitting the potential acquisition of unauthorized data or services that should be restricted.; The weakness originates from the failure to bind the access‑token audience to the original authorization grant, as identified by CWE‑285. The impact is confined to the authorization layer; it does not provide direct remote code execution or system compromise but allows wide unauthorized access to resources.

The affected product is better‑auth/oauth‑provider. Any installation of this library version prior to 1.7.0‑beta.4 is vulnerable. All versions that have not applied the public fix are potentially impacted until a later patch is installed.

The CVSS score of 5.3 reflects moderate severity, with an exploit likelihood that is uncertain due to the lack of an EPSS score and its absence from the KEV catalog. The attack presumably requires that a client is able to complete an OAuth flow against a legitimate authorization server that hosts the vulnerable provider; no privilege escalation beyond the OAuth client is required. If a user authorizes a client, the attacker can redirect the token issuance and obtain a token for an unrelated audience, thus bypassing authorization boundaries. The absence of an EPSS score indicates no publicly known exploitation at the time of analysis. Users should therefore consider the attack vector likely via legitimate OAuth channels and mitigate promptly.