Cross-resource access via unbound token audiences

Improper authorization in Better Auth OAuth Provider Plugin before 1.7.0-beta.4 allows remote authenticated users to access unrelated resources. At /oauth2/token, the provider accepts a client-chosen resource, checks only the server-wide validAudiences allowlist, and writes it to the JWT aud claim without retaining the authorization or refresh grant's resource set. Exploitation requires a registered client that can complete an OAuth flow and a multi-audience or JWT deployment whose resource servers trust aud; access remains limited to the client's granted scopes.