better-auth versions older than 1.1.20 validate the trustedOrigins list incorrectly, allowing attackers to embed malicious callbackURL values that trick the server into redirecting to arbitrary URLs. Because the redirect occurs after the application accepts a callback URL, an adversary can capture the token the target receives and then use it for an account takeover. This flaw is classified as CWE‑601: Open Redirect, and it can lead to significant loss of confidentiality and integrity for affected accounts.

The component affected is the better‑auth oauth‑provider. All installations running better‑auth before version 1.1.20 are vulnerable. The product runs on Node.js environments; no specific operating‐system constraints were listed.

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it via a web‑based attack path by crafting a callbackURL that bypasses trustedOrigin checks, then redirecting a victim to a malicious site to retrieve the token.