Open Redirect Vulnerability in better-auth Affects Trust Validation Logic
CVE-2025-71403

7.1HIGH

Key Information:

Vendor

Better-auth

Status
Better-auth
Vendor
CVE Published:
1 August 2026

What is CVE-2025-71403?

A bypass vulnerability exists in the trustedOrigins validation logic of better-auth, affecting versions prior to 1.1.20. This flaw allows attackers to manipulate callbackURL parameters, successfully circumventing origin checks and triggering open redirects. Such attacks can lead to the theft of sensitive tokens, potentially resulting in account takeover incidents. It is critical for users to upgrade to the patched version to prevent exploitation of this vulnerability.

Affected Version(s)

better-auth 0 < 1.1.20

better-auth 1.1.20

References

https://github.com/better-auth/better-auth/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/better-auth-before-o...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

castilho101
.