Path Normalization Bypass in Better Auth by Better-Call

CVE-2025-71399

What is CVE-2025-71399?

In versions of Better Auth prior to 1.4.5, the routing library rou3 processes URL paths in a way that allows attackers to bypass the disabledPaths configuration and path-based rate limits. Specifically, the normalization process removes empty segments, causing different variations of a URL path (such as /path, //path, and ///path) to resolve to the same route. This misbehavior can be exploited when extra slashes are included in the URL, potentially allowing unauthorized actions. It is important to note that this vulnerability is mitigated in setups where URL normalization is managed by the proxy or platform, collapsing unnecessary slashes.

References