diff --git a/.changeset/v1-remote-auth-callbacks.md b/.changeset/v1-remote-auth-callbacks.md
new file mode 100644
index 0000000000..7752e9096a
--- /dev/null
+++ b/.changeset/v1-remote-auth-callbacks.md
@@ -0,0 +1,7 @@
+---
+"@cloudflare/vite-plugin": patch
+---
+
+Validate OAuth callbacks during remote binding login in Vite development
+
+Upgrade the retained remote-bindings authentication dependency to `@cloudflare/workers-auth` `0.15.4` so unrelated browser callbacks leave the pending login available and provider error text cannot inject terminal control characters.
diff --git a/packages/remote-bindings/package.json b/packages/remote-bindings/package.json
index ea4497dc7e..ff273b568a 100644
--- a/packages/remote-bindings/package.json
+++ b/packages/remote-bindings/package.json
@@ -33,7 +33,7 @@
 	"dependencies": {
 		"@cloudflare/cli-shared-helpers": "0.3.0",
 		"@cloudflare/deploy-helpers": "0.24.3",
-		"@cloudflare/workers-auth": "0.15.1",
+		"@cloudflare/workers-auth": "0.15.4",
 		"@cloudflare/workers-utils": "0.50.1",
 		"chalk": "catalog:default",
 		"miniflare": "5.20261023.3-beta",