Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2025-71403

better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

better-auth better-auth

Default version status: unaffected

  • 0 to < 1.1.20affected
  • 1.1.20unaffected
pkg:npm/better-auth

References