@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an O…
Medium CVSS 6.4
Summary
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/better-auth/better-auth/security/advisories/GHSA-p2fr-6hmx-4528
- https://www.vulncheck.com/advisories/better-auth-oauth-provider-before-beta-4-authorization-bypass
Timeline
- nvd_ingest NVD