better-auth prior to version 1.6.13, including pre‑release 1.7.0‑beta.0 to 1.7.0‑beta.3, fails to validate the URI scheme for redirect_uris registered via the deprecated oidc‑provider and mcp plugins. An attacker can register an OAuth client that uses a javascript: redirect_uri. The authorization server returns this unmodified in the consent response. If the consent page navigates the browser to that URI, the injected JavaScript executes in the context of the authorization‑server origin, exposing the victim’s session cookie and allowing an attacker to take over the victim’s account. The flaw is a stored XSS vulnerability (CWE‑79) that can lead to credential theft and account takeover.

The affected product is better‑auth, the OAuth provider library. Versions prior to 1.6.13, as well as the pre‑release builds 1.7.0‑beta.0 through 1.7.0‑beta.3, contain the issue. The flaw originates from the relaxed validation in the deprecated oidc‑provider and mcp plugins. Any deployment that has enabled these plugins and has not updated to a fixed release is affected.

The CVSS score of 5.1 indicates medium severity. Exploit probability is unknown as EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack chain requires an attacker to register a malicious OAuth client and for a legitimate user to consent to the authorization request. Once the consent page redirects to the attacker‑controlled javascript: URI, the stored XSS is triggered. Because the flaw relies on registered client data and user interaction, the likelihood of mass exploitation is limited but the impact of a successful compromise is high, potentially allowing session hijacking and account takeover.