CVE-2026-67333 better-auth CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the better-auth library should be aware of this vulnerability and take steps to verify their inventory and apply necessary updates.

Why it matters

Defenders should prioritize verifying their inventory of better-auth library versions and applying necessary updates to prevent potential account takeover. The vulnerability allows an attacker to register an OAuth client with a javascript: redirect_uri, leading to potential execution of JavaScript in the authorization-server origin.

• Potential account takeover due to execution of JavaScript in the authorization-server origin
• Exposure of victim's session due to lack of validation of redirect_uri scheme
• Need for verification of better-auth library version and validation of registered redirect_uris

Technical summary

The better-auth library before version 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fails to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. This allows an attacker to register an OAuth client with a javascript: redirect_uri, which can lead to the execution of JavaScript in the authorization-server origin, potentially exposing the victim's session and enabling account takeover.

Defensive priority

Defenders should prioritize verifying their inventory of better-auth library versions and applying the necessary updates to prevent potential account takeover.

Recommended defensive actions

• Verify the version of the better-auth library in use and update to version 1.6.13 or later
• Review and validate the redirect_uris registered via the oidc-provider and mcp plugins
• Implement additional security measures to prevent account takeover, such as monitoring and incident response planning
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the better-auth library. The CVE Program and NIST National Vulnerability Database have assessed the vulnerability and provided CVSS scores.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.