What happened
Published August 1, 2026 (CVSS 7.2/High). A companion flaw to CVE-2026-67336: better-auth's deprecated oidc-provider and mcp plugins do not restrict redirect_uri schemes, permitting non-HTTP(S) schemes like `javascript:` to be registered as valid OAuth redirect targets.
Why it matters
Because the mcp plugin wraps the same vulnerable OIDC provider, this affects any MCP deployment relying on better-auth for OAuth-based tool/resource authorization — an attacker-controlled redirect can hijack authorization codes or tokens intended for legitimate MCP clients.
Attack vector
The OIDC provider and mcp plugin (which wraps the same provider) fail to validate the URI scheme of registered `redirect_uris`, allowing an attacker to register an OAuth client with a `javascript:` redirect URI, enabling token/code theft via script execution in the authorization redirect flow.
Affected systems
better-auth < 1.6.13 and pre-release 1.7.0-beta.0 through 1.7.0-beta.3 (deprecated oidc-provider plugin and mcp plugin)
Mitigation
Upgrade better-auth to 1.6.13 or later (avoid the affected 1.7.0-beta.0–beta.3 range). See GHSA-86j7-9j95-vpqj.