A stored Cross-Site Scripting vulnerability in better-auth allows authenticated users to execute malicious scripts, posing a risk to session integrity and user data.

This is a stored Cross-Site Scripting (XSS) flaw (CWE-79) triggered via a JavaScript redirect URI. The vulnerability requires the attacker to have low-level privileges to inject the payload.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a victim session. This can lead to session hijacking, unauthorized actions performed on behalf of users, or the theft of sensitive information, justifying the high severity CVSS score of 7.2.

Immediate Action: Update the better-auth npm package to version 1.6.13 or 1.7.0-beta.4 or later.

Proactive Monitoring: Audit application logs for unusual redirect patterns or attempts to inject script tags into URI parameters.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed and prevent inline script execution.

Public Exploit Available: Unknown

The presence of a stored XSS vulnerability in an authentication library is significant. Administrators must prioritize updating to the patched versions immediately to prevent potential account takeover scenarios and ensure application security.