CVE-2025-71403
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | better-auth | 0 < 1.1.20 | affected |
| better-auth | better-auth | 1.1.20 | unaffected |
Weaknesses
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
- https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.