GHSA-86j7-9j95-vpqj: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
A stored cross-site scripting (XSS) vulnerability exists in the Better Auth authorization server when using the deprecated oidc-provider or mcp plugins in versions prior to 1.6.13. The vulnerability arises from improper validation of redirect_uri values during OAuth client registration, allowing an attacker to register a javascript: URI. When the consent page navigates to this URI, attacker-controlled JavaScript executes in the authorization server origin, risking session exposure and account takeover. The issue is fixed in better-auth versions 1.6.13 and later.
AI Analysis
Technical Summary
The Better Auth authorization server's deprecated oidc-provider and mcp plugins do not validate the scheme of redirect_uris during OAuth client registration, allowing storage of javascript: URIs. During the OAuth consent flow, the server returns this URI in the consent response, which a vulnerable client application then navigates to (e.g., via window.location.href). This causes execution of attacker-controlled JavaScript in the authorization server origin, exposing session data and enabling account takeover. The vulnerability affects better-auth versions prior to 1.6.13 (stable) and 1.7.0-beta versions before 1.7.0-beta.4. The newer @better-auth/oauth-provider package enforces strict scheme validation and is not affected. The issue is fixed by adding scheme validation to redirect_uris in [email protected] and 1.7.0-beta.4.
Potential Impact
An attacker can register an OAuth client with a malicious javascript: redirect URI, which is later returned by the authorization server during the consent flow. If the client application assigns this URI to a browser navigation target, attacker JavaScript executes in the authorization server's origin. This can expose the victim's session and enable account takeover. The vulnerability requires the use of the deprecated oidc-provider or mcp plugins and a consent page that navigates to the redirectURI value. The default configuration limits dynamic client registration to authenticated users, but enabling allowDynamicClientRegistration allows unauthenticated attackers to register malicious clients.
Mitigation Recommendations
A fix is available in better-auth version 1.6.13 (stable) and 1.7.0-beta.4 (pre-release) that adds scheme validation to redirect_uris, preventing javascript: URIs. Operators should upgrade to these versions to remediate the vulnerability. If upgrading is not immediately possible, developers should avoid navigating to the redirectURI value directly in client-side code or complete the consent flow with server-side redirects, which do not follow javascript: URLs. Using the newer @better-auth/oauth-provider package, which enforces safe URL schemes, also mitigates this issue.
GHSA-86j7-9j95-vpqj: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Description
A stored cross-site scripting (XSS) vulnerability exists in the Better Auth authorization server when using the deprecated oidc-provider or mcp plugins in versions prior to 1.6.13. The vulnerability arises from improper validation of redirect_uri values during OAuth client registration, allowing an attacker to register a javascript: URI. When the consent page navigates to this URI, attacker-controlled JavaScript executes in the authorization server origin, risking session exposure and account takeover. The issue is fixed in better-auth versions 1.6.13 and later.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Better Auth authorization server's deprecated oidc-provider and mcp plugins do not validate the scheme of redirect_uris during OAuth client registration, allowing storage of javascript: URIs. During the OAuth consent flow, the server returns this URI in the consent response, which a vulnerable client application then navigates to (e.g., via window.location.href). This causes execution of attacker-controlled JavaScript in the authorization server origin, exposing session data and enabling account takeover. The vulnerability affects better-auth versions prior to 1.6.13 (stable) and 1.7.0-beta versions before 1.7.0-beta.4. The newer @better-auth/oauth-provider package enforces strict scheme validation and is not affected. The issue is fixed by adding scheme validation to redirect_uris in [email protected] and 1.7.0-beta.4.
Potential Impact
An attacker can register an OAuth client with a malicious javascript: redirect URI, which is later returned by the authorization server during the consent flow. If the client application assigns this URI to a browser navigation target, attacker JavaScript executes in the authorization server's origin. This can expose the victim's session and enable account takeover. The vulnerability requires the use of the deprecated oidc-provider or mcp plugins and a consent page that navigates to the redirectURI value. The default configuration limits dynamic client registration to authenticated users, but enabling allowDynamicClientRegistration allows unauthenticated attackers to register malicious clients.
Mitigation Recommendations
A fix is available in better-auth version 1.6.13 (stable) and 1.7.0-beta.4 (pre-release) that adds scheme validation to redirect_uris, preventing javascript: URIs. Operators should upgrade to these versions to remediate the vulnerability. If upgrading is not immediately possible, developers should avoid navigating to the redirectURI value directly in client-side code or complete the consent flow with server-side redirects, which do not follow javascript: URLs. Using the newer @better-auth/oauth-provider package, which enforces safe URL schemes, also mitigates this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-86j7-9j95-vpqj
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4e4ef7c9d9e3dbe328cc11
Added to database: 07/08/2026, 13:21:59 UTC
Last enriched: 07/08/2026, 13:44:56 UTC
Last updated: 07/08/2026, 13:44:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.