---
id: CVE-2026-67333
title: >-
  better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through
  1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the
  deprecated oidc-provider plugin and the mcp plugin (which wraps the same
  provider)
summary: >-
  better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through
  1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the
  deprecated oidc-provider plugin and the mcp plugin (which wraps the same
  provider). An a…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:34:34.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67333'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-86j7-9j95-vpqj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-before-stored-xss-via-javascript-redirect-uri
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00263
epssPercentile: 0.16309
ingestedAt: '2026-08-02T08:18:07.647Z'
---

## Overview

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.