Executive brief
Better Auth's oidc-provider plugin (now deprecated) fails to validate the scheme of OAuth redirect URIs during client registration, allowing an attacker to inject a malicious javascript: URL. When a user approves an OAuth consent flow, this crafted URL is returned to the browser and executed in the authorization server's origin, giving the attacker access to the victim's session and enabling account takeover.
Technical details
The vulnerability is a stored XSS in the oidc-provider plugin (deprecated) caused by insufficient input validation on OAuth client redirect URIs. The POST /oauth2/register endpoint accepts redirect_uris as a simple string array without scheme validation, allowing an attacker to store a javascript: URI (e.g., javascript:fetch('/api/auth/get-session')//). During the OAuth authorization-code flow, when a user approves on the consent screen, the handler constructs a URL with the stored malicious redirect_uri, which passes through unchanged and is returned in the JSON response. When the consent page navigates to this value using window.location.href, the javascript: scheme executes in the authorization server origin, exposing the victim's session and enabling account takeover. The attack requires either (a) allowDynamicClientRegistration enabled for unauthenticated registration, or (b) an authenticated attacker to register the client, plus (c) a client-side consent page that navigates to the returned redirectURI. The mcp plugin carries the same defect. Patches are available in better-auth@1.6.13 (stable) and 1.7.0-beta.4 (pre-release).
Affected products
- Better Auth better-auth < 1.6.13, >= 1.7.0-beta.0 and < 1.7.0-beta.4
Timeline
- 2026-07-07: disclosed: GHSA-86j7-9j95-vpqj published
- 2026-05-31: advisory: Security advisory published by Better Auth
- 2026-07-07: patched: Fixed in better-auth@1.6.13 and 1.7.0-beta.4