CVE-2025-71400

CVE-2025-71400 affects better-auth passkey up to version 1.3.x (before 1.4.0). The vulnerability is an insecure direct object reference in the delete-passkey endpoint that allows authenticated users to delete arbitrary passkeys by ID, enabling attackers with valid sessions to remove other users’ ...