Packages / @better-auth/passkey / Security

HighVulnerabilityGHSA-4vcf-q4xf-f48mCVE-2025-71400Published 25 Nov 2025

Better Auth Passkey Plugin allows passkey deletion through IDOR

Affected · @better-auth/passkey

  • < 1.4.0

Fixed in

1.4.0

npm install @better-auth/passkey@1.4.0

  1. Not affected

    1.4.0 – 1.7.12

    77 releases, latest

77 stable releases of @better-auth/passkey, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for @better-auth/passkey. It is read in your browser and sent nowhere.

What happens

Summary

Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey.

Details

ctx.body.id is implicitly trusted and used in passkey deletion queries.

better-auth applications configured with useNumberId may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.