https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-53518.htmlhttps://patchthecve.com/cve/CVE-2026-53518.htmlTue, 21 Jul 2026 16:03:12 +0000HIGH 8.1: Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurhttps://patchthecve.com/cve/CVE-2026-53517.htmlhttps://patchthecve.com/cve/CVE-2026-53517.htmlTue, 21 Jul 2026 16:00:22 +0000HIGH 8.1: Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing conhttps://patchthecve.com/cve/CVE-2026-41427.htmlhttps://patchthecve.com/cve/CVE-2026-41427.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict cl