AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in…? What should I do?

    The deprecated oidc-provider plugin registers OAuth clients without validating the scheme of their redirect_uris.

    Affected: better-auth 1.6.12 and earlier, and 1.7.0-beta.0 to 1.7.0-beta.3. Fixed in: 1.6.13 (stable) and 1.7.0-beta.4 (pre-release). What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/ghsa-86j7-9j95-vpqj-better-auth (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: better-auth 1.6.12 and earlier, and 1.7.0-beta.0 to 1.7.0-beta.3. Fixed in: 1.6.13 (stable) and 1.7.0-beta.4 (pre-release).

      • Check your version: run npm ls better-auth. Versions < 1.6.13 of better-auth are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install better-auth@1.6.13 (first patched version 1.6.13).
      2. Upgrade to better-auth@1.6.13 (stable) or 1.7.0-beta.4 (pre-release).
      3. Before navigating, parse the returned value and navigate only when its scheme is http: or https:.
      4. Migrate to @better-auth/oauth-provider.
      5. Keep allowDynamicClientRegistration at its default of false and restrict who can register clients.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/ghsa-86j7-9j95-vpqj-better-auth (opens external site)

      Did this work for you?

    Add your answer or comment