CVE-2026-67333 Overview
CVE-2026-67333 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the better-auth authentication library. Versions before 1.6.13, along with pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3, fail to validate the scheme of redirect_uris registered through the deprecated oidc-provider plugin and the mcp plugin that wraps it.
An attacker registers an OAuth client using a javascript: URI as the redirect target. The authorization server returns the value unchanged in the consent response. If the consent page navigates the browser to that value, the injected script executes in the authorization-server origin.
Critical Impact
Successful exploitation exposes the victim's authenticated session and enables account takeover within the authorization-server origin.
Affected Products
- better-auth versions prior to 1.6.13
- better-auth pre-release 1.7.0-beta.0 through 1.7.0-beta.3
- Deployments using the deprecated oidc-provider plugin or the mcp plugin
Discovery Timeline
- 2026-08-01 - CVE-2026-67333 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67333
Vulnerability Analysis
The flaw resides in the OAuth 2.0 / OpenID Connect client registration flow provided by the oidc-provider plugin. Dynamic client registration accepts arbitrary strings for redirect_uris without enforcing an allow-list of URI schemes such as https: or http:.
When the authorization server later constructs the consent response, it echoes the attacker-controlled redirectURI value back to the consent page. Deployments that assign the returned value directly to window.location.href trigger navigation to a javascript: URI. The browser evaluates the payload in the origin of the authorization server.
Because the payload executes under the authorization server's origin, the attacker's script can read session cookies accessible to that origin, invoke authenticated endpoints, and pivot to full account takeover of any user who reaches the malicious consent flow. The mcp plugin inherits the same vulnerable provider code path.
Root Cause
The root cause is missing scheme validation on the redirect_uri field during OAuth client registration and reflection. The library does not restrict registered URIs to safe navigational schemes, allowing pseudo-schemes such as javascript: and data: to persist through to the consent response.
Attack Vector
An attacker registers an OAuth client via the exposed dynamic client registration endpoint, supplying a javascript: payload as a redirect_uri. The attacker then lures an authenticated victim to the resulting authorization request. When the consent page hands the stored redirectURI to window.location.href, the attacker's script runs with the victim's session context.
The vulnerability requires low privileges to register a client and user interaction to reach the consent page. See the GitHub Security Advisory and the VulnCheck Advisory for XSS for further detail.
Detection Methods for CVE-2026-67333
Indicators of Compromise
- OAuth client registration records containing redirect_uris beginning with javascript:, data:, or vbscript:.
- Consent page navigations where the outbound URL scheme is not http: or https:.
- Anomalous session activity or token issuance immediately following a consent flow tied to a newly registered client.
Detection Strategies
- Audit the client registration data store for any redirect_uri value that does not begin with an approved scheme.
- Instrument the consent page to log the redirectURI value prior to navigation and alert on non-standard schemes.
- Review authorization server access logs for dynamic client registrations from untrusted networks or unauthenticated callers.
Monitoring Recommendations
- Enable web application logging on the /oauth/register and consent endpoints exposed by better-auth.
- Correlate client registration events with subsequent authorization requests using the same client_id.
- Monitor browser Content Security Policy (CSP) violation reports from the authorization-server origin for inline script execution attempts.
How to Mitigate CVE-2026-67333
Immediate Actions Required
- Upgrade better-auth to version 1.6.13 or later, or to a stable 1.7.0 release outside the affected beta range.
- Inventory existing OAuth clients and delete any entry whose redirect_uris contain non-http(s): schemes.
- Disable the deprecated oidc-provider plugin and the mcp plugin until patched builds are deployed.
Patch Information
The maintainers addressed the issue in better-auth1.6.13. Details of the fix are documented in the GitHub Security Advisory GHSA-86j7-9j95-vpqj. Deployments running the affected 1.7.0-beta builds must move to a stable release that contains the scheme-validation fix.
Workarounds
- Enforce a server-side allow-list that rejects any redirect_uri not starting with https:// at registration time.
- Validate the redirectURI returned to the consent page before navigation and refuse pseudo-schemes.
- Apply a strict Content Security Policy on the authorization-server origin to block inline script execution from javascript: URIs.
# Configuration example: restrict OAuth client registration to https redirect_uris
# Apply validation in the application layer before persisting client records
# Reject if redirect_uri does not match ^https:\/\/ (or ^http:\/\/localhost for dev)
npm install better-auth@^1.6.13
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
