CVE-2026-67333

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.13 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.3

Description The deprecated oidc-provider plugin and the mcp plugin fail to validate the scheme of redirect uris during OAuth client registration. An attacker can register a client using a javascript: URI via the POST /oauth2/register endpoint. This malicious URI is stored and subsequently returned unchanged in the consent response of the GET /oauth2/authorize endpoint. If the application's consent page assigns the returned redirectURI variable to a browser navigation target (such as window.location.href, location.assign, or location.replace), the attacker's JavaScript executes within the authorization server's origin. This stored DOM cross-site scripting (XSS) allows the attacker to access session-scoped endpoints, such as /api/auth/get-session, leading to session exposure and account takeover.

Recommendations Upgrade to better-auth version 1.6.13 or later. Upgrade to better-auth version 1.7.0-beta.4 or later. Migrate from the deprecated oidc-provider plugin to @better-auth/oauth-provider. Harden the consent page by parsing the redirectURI and ensuring the scheme is strictly http: or https: before navigating. Set allowDynamicClientRegistration to false and restrict client registration to trusted users to reduce the attack surface.