CVEvulnerability

CVE-2025-71403

7.1 HIGH Published 2026-08-01 Modified 2026-10-06 Official page ↗

Status: Deferred
Published: 2026-08-01
Last modified: 2026-10-06
Assigner: [email protected]
CVSS 4.0 ([email protected]): 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Weaknesses: CWE-601

Description

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

Weakness · CWE (1)

CWE-601 URL Redirection to Untrusted Site weakness

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x github.com
https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass www.vulncheck.com

CVE-2025-71403

Description

Related

Weakness · CWE (1)

References