Insufficient Session Expiration Affecting @better-auth/memory-adapter package, versions >=1.6.0 <1.6.11
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BETTERAUTHMEMORYADAPTER-17889814
- published8 Jul 2026
- disclosed7 Jul 2026
- creditDaniel Müller
Introduced: 7 Jul 2026
CVE-2026-53517 (opens in a new tab)How to fix?
Upgrade @better-auth/memory-adapter to version 1.6.11 or higher.
Overview
@better-auth/memory-adapter is a Memory adapter for Better Auth
Affected versions of this package are vulnerable to Insufficient Session Expiration through the POST /oauth2/token endpoint during the refresh token granting. An attacker can gain unauthorized access by exploiting a race condition in concurrent refresh token redemption, allowing indefinite access through forked refresh-token families even after revocation attempts.
Note: This is only exploitable if an OAuth client requests the offline_access scope and concurrent redemption of the same refresh token is possible, such as when a single refresh token is shared across browser tabs or a stolen token is used in timed requests.
Workaround
This vulnerability can be mitigated by configuring the database adapter to use serializable isolation or row-level pessimistic locking, reducing the race window; setting a short refresh token lifetime; serializing refresh-token usage in the client SDK with a mutex; or disabling refresh tokens by not requesting the offline_access scope.