Packages / better-auth / Security

HighVulnerabilityGHSA-vp58-j275-797xCVE-2025-71403Published 24 Feb 2025

Better Auth allows bypassing the trustedOrigins Protection which leads to ATO

Affected releases · better-auth

  • 1.x1.0.0 – 1.1.20Fixed in 1.1.21
  • 0.8.x and older0.0.1 – 0.8.8No fix, no longer updated

On 1.x, the newest line:

npm install better-auth@1.1.21
1.x

  1. Affected

    1.0.0 – 1.1.20

    43 releases

  2. Fixed

    1.1.21 – 1.7.12

    126 releases, latest

0.x

  1. Affected

    0.0.1 – 0.8.8

    61 releases

230 stable releases of better-auth, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for better-auth. It is read in your browser and sent nowhere.

What happens

Summary

A bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.

Because redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.