THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67333 (HIGH 7.2) — better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a

[NVD] CVE-2026-67333 (HIGH 7.2) — better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a

mednvdPublished 2026-08-01

CVE-2026-67333 CVSS: 7.2 HIGH Published: 2026-08-01T13:17:04.123

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization ser

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-67333cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67333