A stored XSS vulnerability exists in better-auth versions before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3. The flaw stems from a failure to validate the URI scheme of redirect_uris registered through the deprecated oidc-provider plugin and the mcp plugin. An attacker can register an OAuth client with a malicious 'javascript:' redirect_uri, which the authorization server returns unmodified in the consent response. If the consent page navigates the browser to the returned URI (e.g., via window.location.href), the attacker's JavaScript executes in the authorization-server origin. This enables session hijacking and full account takeover of victim users. The vulnerability affects deployments using the OIDC or MCP plugin features of better-auth. A fix is available in version 1.6.13 and later stable releases.