Incorrect Authorization Affecting @better-auth/oauth-provider package, versions >=1.4.8 <1.7.0-beta.4

@better-auth/oauth-provider is an An oauth provider plugin for Better Auth

Affected versions of this package are vulnerable to Incorrect Authorization due to the OAuth token and refresh flows in packages/oauth-provider/src/token.ts, packages/oauth-provider/src/authorize.ts, and packages/oauth-provider/src/consent.ts. An attacker can obtain an access token for an allow-listed audience that the authorization grant never covered by supplying a different resource value at the token endpoint, or widen a refresh token to another audience by redeeming it with a new resource value. This lets a client use a token at a resource server that the user did not authorize, causing unauthorized access to resource-specific APIs and data when those servers trust the token’s aud or resource claim.

Workarounds

• Set validAudiences to a single audience, or leave it unset so it defaults to your base URL; this prevents clients from choosing a different allow-listed resource at the token endpoint.
• Configure each resource server to accept a token only when its own identifier is the expected aud, and reject tokens whose aud is an array that also lists other audiences; this limits use of tokens minted for multiple resources.
• Do not rely on the resource indicator as an authorization boundary until you upgrade to a release that includes the fix; this avoids treating an unbound audience as proof of user authorization.

• GitHub Commit v1.7.0-beta.4
• GitHub Release
• Maintainer's Advisory