better-auth oidc-provider stored XSS via malicious redirect_uri

Vulnerability Overview Title: Description: This vulnerability involves a stored Cross-Site Scripting (XSS) attack in the project through the plugin (deprecated). An attacker can execute arbitrary JavaScript code on the authorization server by crafting a malicious parameter, thereby stealing user sessions or performing other malicious actions. Scope of Impact Affected Versions: - = 1.7.0-beta.0, < 1.7.0-beta.4 Affected Conditions: - The or plugin is enabled. - The version is 1.6.12 or an earlier stable release, or a pre-release version of 1.7.0-beta. - The consent page is a client-side component that reads and assigns it to the browser navigation target (e.g., , , or ). - is set, allowing unauthenticated users to register clients. - The consent page is exposed to general users rather than being restricted to operators only. Remediation Version Upgrade: - Upgrade to (stable version) or (pre-release version). Workarounds: - If an upgrade is not possible, the following measures can be taken: - In the consent page, parse the returned value and only navigate when the scheme is or . - Migrate to the plugin, which validates redirect URIs and supports MCP. - Keep at its default value of and restrict the paths for registrable clients. Proof of Concept (PoC) Specific PoC code was not provided in the source, but the attack flow is described as follows: 1. The attacker registers a client with a set to . 2. After the user consents to the authorization, the authorization server returns a response containing the malicious . 3. The consent page executes , causing the malicious JavaScript code to execute within the authorization server's origin. Summary This vulnerability allows an attacker to execute arbitrary JavaScript code on the authorization server by crafting a malicious parameter, potentially leading to the theft of user sessions or other malicious actions. It is recommended to upgrade to a fixed version or implement workarounds as soon as possible to mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

better-auth oidc-provider stored XSS via malicious redirect_uri

More from this source