GitHub Advisoryadvisory · npm
GHSA-vp58-j275-797x Better Auth allows bypassing the trustedOrigins Protection which leads to ATO
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- better-auth
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2025-02-24
Affected packages
• npm better-auth: < 1.1.21 → fixed in 1.1.21
Description
Summary
A bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.
Because redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x web
- https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80 web
- https://github.com/better-auth/better-auth package
- https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53 web