@better-auth/oauth-provider is an An oauth provider plugin for Better Auth

Affected versions of this package are vulnerable to Incorrect Authorization due to the OAuth token and refresh flows in packages/oauth-provider/src/token.ts, packages/oauth-provider/src/authorize.ts, and packages/oauth-provider/src/consent.ts. An attacker can obtain an access token for an allow-listed audience that the authorization grant never covered by supplying a different resource value at the token endpoint, or widen a refresh token to another audience by redeeming it with a new resource value. This lets a client use a token at a resource server that the user did not authorize, causing unauthorized access to resource-specific APIs and data when those servers trust the token’s aud or resource claim.

Workarounds

Set validAudiences to a single audience, or leave it unset so it defaults to your base URL; this prevents clients from choosing a different allow-listed resource at the token endpoint.
Configure each resource server to accept a token only when its own identifier is the expected aud, and reject tokens whose aud is an array that also lists other audiences; this limits use of tokens minted for multiple resources.
Do not rely on the resource indicator as an authorization boundary until you upgrade to a release that includes the fix; this avoids treating an unbound audience as proof of user authorization.

version	published	direct vulnerabilities
1.5.0-beta.1	23 Dec, 2025	0 C 0 H 2 M 0 L
1.4.9	23 Dec, 2025	0 C 0 H 2 M 0 L
1.4.8	23 Dec, 2025	0 C 0 H 2 M 0 L
1.4.8-beta.7	22 Dec, 2025	0 C 0 H 1 M 0 L

@better-auth/oauth-provider

An oauth provider plugin for Better Auth

Package versions

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.