https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:53:51 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-67333 <p>better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment&#39;s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker&#39;s JavaScript executes in the authorization-server origin, exposing the victim&#39;s session and enabling account takeover.</p> <p>better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment&#39;s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker&#39;s JavaScript executes in the authorization-server origin, exposing the victim&#39;s session and enabling account takeover.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-67333 https://vulnerability.circl.lu/vuln/ghsa-w277-2xmj-j2rc <p>better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment&#39;s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker&#39;s JavaScript executes in the authorization-server origin, exposing the victim&#39;s session and enabling account takeover.</p> <p>better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment&#39;s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker&#39;s JavaScript executes in the authorization-server origin, exposing the victim&#39;s session and enabling account takeover.</p> https://vulnerability.circl.lu/vuln/ghsa-w277-2xmj-j2rc