EUVD-2025-33358

Better Auth: Unauthenticated API key creation through api-key plugin...

Better Auth 安全漏洞

Better Auth is a TypeScript's most comprehensive authentication framework open-sourced by Better Auth. A security vulnerability exists in versions of Better Auth prior to 1.3.26 that originates from an unauthenticated attacker who can bypass authentication via the user ID in the request body,...

CVE-2025-61928: Improper Authorization

Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the api/auth/api-key/create route. session?.user ?? authRequired ? null : i...

CVE-2025-53535

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This...

@better-auth/cli (>=1.0.0-canary.2, <=1.2.9), @erquhart/convex-better-auth (0.4.1) +11 more potentially affected by CVE-2025-53535 via better-auth (>=1.0.0, <=1.2.9-beta.10)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.0, =0.1.174, =1.0.2, =1.0.5, =1.0.0, =0.0.5, =1.1.368, =3.7.1, =0.1.2-beta.2, =1.0.0, =1.1.0 Source cves: CVE-2025-53535 Source advisory: OSV:GHSA-36RG-GFQ2-3H56...

CVE-2025-53535 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This...

CVE-2025-53535 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This...

CVE-2025-53535 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This...

CVE-2025-53535

Better Auth Open Redirect (CVE-2025-53535) involves the TypeScript authentication/authorization library where the originCheck middleware incorrectly validates URLs, enabling an open redirect on routes including /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, and ...

Better Auth 输入验证错误漏洞

Better Auth is a TypeScript's most comprehensive authentication framework open-sourced by Better Auth. An input validation error vulnerability exists in versions of Better Auth prior to 1.2.10, which stems from the presence of an open redirect in the originCheck middleware function, which could...

CVE-2025-53535: URL Redirection to Untrusted Site

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This...

PT-2025-28223 · Unknown · Better Auth

Name of the Vulnerable Software and Affected Versions: Better Auth versions prior to 1.2.10 Description: An open redirect issue has been found in the originCheck middleware function of Better Auth, an authentication and authorization library for TypeScript. The affected routes include...

CVE-2025-53535

creationtimestamp| type| source ---|---|--- 2025-07-06 06:31:33+00:00| published-proof-of-concept| https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56...

better-auth-cloudflare (0.1.0) potentially affected by CVE-2025-6087 +1 more via @opennextjs/cloudflare (1.0.1)

@opennextjs/cloudflare NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 Source cves: CVE-2025-6087, CVE-2026-3125 Source advisory: OSV:GHSA-RVPW-P7VW-WJ3M...

CVE-2025-27143

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

CVE-2025-27143

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.20), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-71403 via better-auth (>=1.0.0, <=1.1.20-beta.5)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-71403 Source advisory: OSV:GHSA-VP58-J275-797X...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.19), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-27143 via better-auth (>=1.0.0, <=1.1.19-beta.3)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-27143 Source advisory: OSV:GHSA-HJPM-7MRM-26W8...