A stored cross-site scripting (XSS) vulnerability exists in the Better Auth authorization server when using the deprecated oidc-provider or mcp plugins in versions prior to 1.6.13. The vulnerability arises from improper validation of redirect_uri values during OAuth client registration, allowing an attacker to register a javascript: URI. When the consent page navigates to this URI, attacker-controlled JavaScript executes in the authorization server origin, risking session exposure and account takeover. The issue is fixed in better-auth versions 1.6.13 and later.