From fab61af713c99b20a4d7bd2788be4fdfe482e0ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paola=20Estefan=C3=ADa=20de=20Campos?=
 <84341268+Paola3stefania@users.noreply.github.com>
Date: Mon, 16 Feb 2026 14:26:07 -0800
Subject: [PATCH] fix: encode callbackURL in delete-user verification email
 (#8007)

(cherry picked from commit a2f6fbce5a1b3b7176d86e755eed559f7e5bd603)
---
 packages/better-auth/src/api/routes/update-user.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/better-auth/src/api/routes/update-user.ts b/packages/better-auth/src/api/routes/update-user.ts
index 002e8ddd47..7423b6a867 100644
--- a/packages/better-auth/src/api/routes/update-user.ts
+++ b/packages/better-auth/src/api/routes/update-user.ts
@@ -527,9 +527,9 @@ export const deleteUser = createAuthEndpoint(
 			});
 			const url = `${
 				ctx.context.baseURL
-			}/delete-user/callback?token=${token}&callbackURL=${
-				ctx.body.callbackURL || "/"
-			}`;
+			}/delete-user/callback?token=${token}&callbackURL=${encodeURIComponent(
+				ctx.body.callbackURL || "/",
+			)}`;
 			await ctx.context.runInBackgroundOrAwait(
 				ctx.context.options.user.deleteUser.sendDeleteAccountVerification(
 					{