CVE-2025-71399
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Better Auth relies on the rou3 router library, which normalizes URL paths by removing empty segments. In Better Auth versions prior to 1.4.5, an attacker can bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply when the proxy or platform normalizes URLs by collapsing multiple slashes.
Risk Assessment
An attacker can bypass path access controls and rate limits, potentially leading to unauthorized access to features or server overload.
Recommendation
Update Better Auth to version 1.4.5 or later, which includes the fixed rou3. If possible, configure the proxy or platform to normalize URLs by collapsing multiple slashes.
Other vulnerabilities in Better Auth
See all- CVE-2026-53513Critical
Better Auth library before version 1.6.11 has a vulnerability in the @better-auth/sso plugin. The POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled URLs (oidcConfig.userInfoEndpoint, tokenEndpoint, jwksEndpoint) when skipDiscovery: true is set, store them without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery (SSRF) and potential account linking when trustEmailVerified: true is configured.
- CVE-2026-53512Critical
Better Auth before version 1.6.11 has a vulnerability in the legacy oidcProvider and mcp plugins where OAuth token endpoints authenticate only possession of a valid refresh_token and client_id, without verifying the client_secret. This allows an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens via /api/auth/oauth2/token or /api/auth/mcp/token.
- CVE-2025-71401Medium
better-auth (npm) before version 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.
- CVE-2025-71400High
better-auth passkey before version 1.4.0 has an insecure direct object reference vulnerability in the passkey deletion endpoint. Authenticated users can delete arbitrary passkeys of other users.
- CVE-2026-67337Medium
Better-auth before version 1.4.9 contains a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
- CVE-2026-67336High
better-auth before version 1.6.11 contains insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.
- CVE-2026-67335Medium
Better-auth before version 1.6.2 fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker's external identity or persistently link attacker accounts to victim profiles.
- CVE-2026-67334Low
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
- CVE-2026-67333High
better-auth before version 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI, the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.
- CVE-2026-67331High
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
Original NVD description (English source)
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.