CyberRota Analysis
AI-GeneratedThe vulnerability affects the better-auth library in Java versions prior to 1.6.13 and specific pre-release builds of 1.7.0, allowing attackers to register malicious OAuth clients with JavaScript redirect URIs. This flaw can lead to unauthorized execution of JavaScript in the authorization server's context, potentially exposing user sessions and facilitating account takeover. Organizations using the affected versions, particularly those implementing OAuth authentication, should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.