EUVD-2026-51810
GHSA-w277-2xmj-j2rc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects default authenticated registration; S:C and C:L/I:L capture cross-origin session exposure via stored XSS; UI:R for required victim consent-page visit.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on better-auth (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.7.0-beta.0.
DescriptionCVE.org
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.
AnalysisAI
Stored XSS in better-auth's deprecated oidc-provider and mcp plugins allows an attacker to register an OAuth client with a javascript: redirect_uri, which the authorization server stores and later returns unchanged in the consent response. If the deployment's consent page is a client-side component that assigns the returned redirectURI to window.location.href or equivalent, the attacker's JavaScript executes in the authorization-server origin - exposing the victim's session tokens and enabling account takeover. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 5.1 reflects required user interaction and limited subsequent-system impact, though deployments with unauthenticated dynamic client registration face elevated real-world risk.
Technical ContextAI
better-auth is a TypeScript/Node.js authentication library distributed via npm, providing drop-in OAuth 2.0 and OpenID Connect server capabilities. The vulnerability resides in the deprecated oidc-provider plugin and its wrapper mcp plugin (cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*), both of which implement client registration without validating the URI scheme of submitted redirect_uris. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: untrusted attacker-controlled data is stored server-side and later reflected into a browser navigation context without sanitization. The javascript: URI scheme is a well-known XSS vector that browsers evaluate when assigned to location properties. The newer @better-auth/oauth-provider package, which is the migration target for both affected plugins, is not vulnerable. The defect is independent of any specific frontend framework - any consent page that performs client-side navigation using the returned URI value is susceptible.
RemediationAI
Vendor-released patches are available: upgrade to better-auth 1.6.13 on the stable line or 1.7.0-beta.4 on the pre-release line; both fix the missing URI scheme validation at client registration time. Advisory: https://github.com/better-auth/better-auth/security/advisories/GHSA-86j7-9j95-vpqj. If an immediate upgrade is not possible, three workarounds reduce or eliminate exposure: first, migrate from the deprecated oidc-provider or mcp plugin to @better-auth/oauth-provider, which does not carry this defect; second, modify the consent page to complete the OAuth flow using a server-side redirect (e.g., a Next.js or Remix server action) rather than assigning the redirectURI to window.location.href - browsers do not evaluate javascript: URIs delivered in HTTP Location headers; third, if allowDynamicClientRegistration is currently set to true, disabling it restricts client registration to authenticated users only, significantly limiting the attacker's ability to plant a malicious client without an existing account. Note that the second workaround requires a consent-page code change and must be verified against the specific framework in use.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today