@better-auth/oauth-provider

1.7.12 · 20 Oct 2026MIT1.6M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for @better-auth/oauth-provider. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	1.7.12	Safe from 1.7.0

Your version

High
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitiveGHSA-7w99-5wm4-3g79 · 7 Jul 2026
- 1.x1.6.0 – 1.6.10Fixed in 1.6.11
High
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemptionGHSA-392p-2q2v-4372 · 7 Jul 2026
- 1.x1.6.0 – 1.6.10Fixed in 1.6.11
High
OAuth 2.1 Provider: Unprivileged users can register OAuth clientsGHSA-xr8f-h2gw-9xh6 · 16 Apr 2026
- 1.x1.4.8 – 1.6.4Fixed in 1.6.5
Moderate
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicatorsGHSA-p2fr-6hmx-4528 · 7 Jul 2026
- 1.x1.4.8 – 1.6.33Fixed in 1.7.0

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.