CVE-2026-67333

Descripción

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment-s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker-s JavaScript executes in the authorization-server origin, exposing the victim-s session and enabling account takeover.