CVE-2024-56734

creationtimestamp| type| source ---|---|--- 2024-12-30 17:13:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113742892903396443 2024-12-30 19:18:30+00:00| seen| https://t.me/cvedetector/13937 2025-02-25 02:19:27+00:00| seen| https://t.me/cvedetector/18841 2025-03-02 11:45:37+00:00|...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.5), @vxrn/better-auth (>=1.1.368, <=1.1.416) potentially affected by CVE-2024-56734 +1 more via better-auth (>=1.0.0, <=1.1.5)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =1.1.368, =1.1.416 Source cves: CVE-2024-56734, CVE-2025-27143 Source advisory: OSV:GHSA-8JHW-6PJJ-8723...

CVE-2024-56734

CVE-2024-56734 affects Better Auth (TypeScript) prior to version 1.1.6, where the verify-email endpoint accepts a callbackURL parameter and uses JWT without proper domain validation. This open-redirect flaw can allow an attacker to redirect users to arbitrary, attacker-controlled sites. Root caus...