Hillalee

**Name of the Vulnerable Software and Affected Versions** better-auth versions prior to 1.6.13 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.3 **Description** The deprecated `oidc-provider` plugin and the `mcp` plugin fail to validate the scheme of `redirect uris` during OAuth client registration. An attacker can register a client using a `javascript:` URI via the `POST /oauth2/register` endpoint. This malicious URI is stored and subsequently returned unchanged in the consent response of the `GET /oauth2/authorize` endpoint. If the application's consent page assigns the returned `redirectURI` variable to a browser navigation target (such as `window.location.href`, `location.assign`, or `location.replace`), the attacker's JavaScript executes within the authorization server's origin. This stored DOM cross-site scripting (XSS) allows the attacker to access session-scoped endpoints, such as `/api/auth/get-session`, leading to session exposure and account takeover. **Recommendations** Upgrade to better-auth version 1.6.13 or later. Upgrade to better-auth version 1.7.0-beta.4 or later. Migrate from the deprecated `oidc-provider` plugin to `@better-auth/oauth-provider`. Harden the consent page by parsing the `redirectURI` and ensuring the scheme is strictly `http:` or `https:` before navigating. Set `allowDynamicClientRegistration` to `false` and restrict client registration to trusted users to reduce the attack surface.