CVE-2026-67333 better-auth CVE debrief

Who should care

Organizations using better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating OAuth client configurations to prevent unauthorized redirect URIs and monitoring for suspicious activity related to OAuth client registrations and redirect URIs. The vulnerability's impact on an organization depends on its use of better-auth and the exposure of its OAuth client configurations. Operators, platform administrators, vulnerability management teams, and security teams should all be aware of the potential risks and take appropriate measures to protect their systems and data. This may involve patching to a secure version of better-auth, reviewing compensating controls, and ensuring that relevant monitoring and detection mechanisms are in place to identify potential exploitation attempts. Additionally, asset inventory management is crucial to understand which systems are affected and prioritize remediation efforts accordingly. Rollback/change windows may also be necessary to apply patches or mitigations without disrupting critical services. Source tracking can help in verifying the effectiveness of the implemented measures and ensuring that the vulnerability is properly managed within the organization's environment. Given the potential for account takeover, swift action is recommended to minimize risk exposure. This involves a coordinated effort across different teams within the organization to ensure comprehensive coverage and effective risk mitigation. By taking these steps, organizations can reduce their exposure to this vulnerability and protect their assets from potential exploitation. Regular review of the CVE record and related advisories is also advised to stay informed about any updates or changes in the vulnerability's status or recommended actions. Furthermore, organizations should consider implementing additional security measures such as multi-factor authentication and enhanced logging to detect and respond to potential security incidents related to this vulnerability. By being proactive and taking a comprehensive approach to managing

Technical summary

The better-auth library before version 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) does not properly validate the scheme of redirect_uris registered via the oidc-provider and mcp plugins. This allows an attacker to register a malicious OAuth client with a javascript: redirect_uri. When the authorization server returns this redirect URI in the consent response, and the deployment's consent page navigates the browser to this URI (e.g., by assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin. This enables the attacker to access the victim's session, potentially leading to account takeover.

Defensive priority

Organizations using better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) should prioritize patching to prevent potential account takeover.

Recommended defensive actions

• Patch better-auth to version 1.6.13 or later
• Review and update OAuth client configurations to prevent unauthorized redirect URIs
• Monitor for suspicious activity related to OAuth client registrations and redirect URIs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description indicates that better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fails to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. This could allow an attacker to register an OAuth client with a javascript: redirect_uri, potentially leading to account takeover.

Official resources