CVE-2026-67333: better-auth before 1.6.13 Stored XSS via javascript redirect_uri
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirecturi, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.6.13 - Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67333?
The severity of CVE-2026-67333 is rated as medium with a score of 5.1.
How do I fix CVE-2026-67333?
To fix CVE-2026-67333, upgrade to better-auth version 1.6.13 or later.
What vulnerability type is CVE-2026-67333 associated with?
CVE-2026-67333 is associated with a Stored XSS vulnerability.
Which versions of better-auth are affected by CVE-2026-67333?
Versions of better-auth prior to 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 are affected by CVE-2026-67333.
What are the potential consequences of CVE-2026-67333?
Exploitation of CVE-2026-67333 can lead to unauthorized JavaScript execution in the context of the victim's browser, resulting in data theft or session hijacking.