CVE-2026-67333

This CVE exposes a javascript: URI injection in better-auth's deprecated oidc-provider and mcp plugins. The CVSS 7.2 rating is accurate but masks a narrower reality: exploitation requires a specific application behavior that is arguably itself a security anti-pattern. The vulnerability allows a malicious client to register a redirect_uri containing javascript: scheme. When the authorization server's consent page renders this URI and navigates to it (via window.location.href assignment, which the consuming application must perform), arbitrary code execution follows. This isn't just a validation gap in the plugin—it's a two-part failure: the plugin failed to validate URI schemes, and the consent page assumed redirect values are safe to navigate. The EPSS score of 0.00158 (0.16th percentile) reflects that this lives in deprecated code paths with low production adoption. But don't let that lull you. The more important question isn't whether threat actors will target this specific plugin—it's whether your consent pages anywhere in the codebase assign redirect values to navigable locations. That pattern is the actual blast radius limiter, and it's almost certainly more widespread than better-auth's deprecated plugin usage. Check three things immediately: first, audit your consent page code for any assignment of redirectURI or similar values to window.location, location.replace, or meta refresh—these should be removed entirely; second, verify whether you have any oidc-provider or mcp plugins instantiated in your dependency tree and remove them if unused; third, confirm that your client registration endpoints enforce scheme validation (allow only https, and urn:ietf:wg:oauth:2.0:oob for legacy flows) at the authorization server core, not at individual plugin layers. The 1.6.13 fix addresses this specific gap, but audit your entire registration surface. Deprecated code escapes active security hardening—any pathway that accepts redirect_uri registration and relies on plugin-level validation rather than core enforcement is a candidate for similar gaps.

Reviewed through automated stages and approved by a human before publication.