CVE-2025-61928

🗓️ 09 Oct 2025 21:24:37Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 45 Views🌐 WEB

Unauthenticated attackers can create or modify API keys for any user in Better Auth before 1.3.26.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2025-61928	15 Oct 202520:53	–	circl
CNNVD	Better Auth 安全漏洞	9 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-61928 Better Auth: Unauthenticated API key creation through api-key plugin	9 Oct 202521:24	–	cvelist
Github Security Blog	Better Auth: Unauthenticated API key creation through api-key plugin	9 Oct 202515:40	–	github
NVD	CVE-2025-61928	9 Oct 202522:15	–	nvd
OSV	CVE-2025-61928 Better Auth: Unauthenticated API key creation through api-key plugin	9 Oct 202521:24	–	osv
OSV	GHSA-99H5-PJCV-GR6V Better Auth: Unauthenticated API key creation through api-key plugin	9 Oct 202515:40	–	osv
Positive Technologies	PT-2025-41497	9 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-61928	13 Oct 202505:29	–	redhatcve
Snyk	Missing Authentication for Critical Function	9 Oct 202515:40	–	snyk

Vulners

Node

better-auth better_authRange<1.3.26

[
  {
    "vendor": "better-auth",
    "product": "better-auth",
    "versions": [
      {
        "version": "< 1.3.26",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39
github	www.github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v

Parameter	Position	Path	Description	CWE
userId	request body	/api/auth/api-key/create	Unauthenticated attacker can create or modify API keys by supplying a victim's id in the request body, bypassing auth when authRequired is false; leads to authentication bypass and privilege escalation.	CWE-285, CWE-306

17 Jun 2026 09:51Current

6.8Medium risk

Vulners AI Score6.8

CVSS 49.3

EPSS0.18012

SSVC