CVE-2026-67333 Details

A stored cross-site scripting vulnerability has been identified in Better Auth versions prior to 1.6.13 and in pre-release builds from 1.7.0-beta.0 to 1.7.0-beta.3. The issue arises in the deprecated oidc-provider plugin and the mcp plugin, which wraps the same provider. These versions fail to validate the scheme of redirect URIs registered through the affected plugins. An attacker can exploit this by registering an OAuth client with a JavaScript redirect URI. When the authorization server returns this URI in the consent response, it can be executed in the authorization server's origin, potentially exposing the victim's session and leading to account takeover.

Users can upgrade to Better Auth version 1.6.13 or 1.7.0-beta.4. If an upgrade is not possible, consent pages can be hardened to validate the scheme of redirect URIs before navigation, or users can migrate to the Better Auth OAuth Provider, which includes the necessary validation. Keeping dynamic client registration disabled and restricting client registration to authenticated users can also help mitigate the risk.