AIKIDO-2026-11094
better-auth is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
better-authTL;DR
The deprecated oidc-provider and mcp plugins in better-auth accept OAuth client redirect_uris without validating URL schemes at registration. An attacker can register a javascript: or data: redirect target that survives the authorization flow and is returned to the consent page as redirectURI. If the operator's consent UI navigates the browser to that value, attacker script runs in the authorization-server origin and can read session-scoped endpoints. The fix rejects javascript:, data:, and vbscript: schemes at registration and blocks unsafe client-side redirects.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 1.6.12.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant