CVE-2025-53535
Last modified
CVE-2025-53535 is a low-severity vulnerability rated 2.1/10 on the CVSS scale. Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-53535?
How severe is CVE-2025-53535?
How do I fix CVE-2025-53535?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-5353A hardcoded key in Ivanti Workspace Control before version 1…7.8
- CVE-2025-53530WeGIA is a web manager for charitable institutions. The Wegi…7.5
- CVE-2025-53531WeGIA is a web manager for charitable institutions. The Wegi…7.5
- CVE-2025-53532giscus is a commenting system powered by GitHub Discussions.…5.3
- CVE-2025-53533Pi-hole Admin Interface is a web interface for managing Pi-h…6.1
- CVE-2025-53534RatPanel is a server operation and maintenance management pa…7.7
- CVE-2025-53536Roo Code is an AI-powered autonomous coding agent. Prior to …8.1
- CVE-2025-53537LibHTP is a security-aware parser for the HTTP protocol and …7.5
- CVE-2025-53538Suricata is a network IDS, IPS and NSM engine developed by t…7.5
- CVE-2025-53539FastAPI Guard is a security library for FastAPI that provide…7.5
- CVE-2025-53540arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.7
- CVE-2025-53541Tuleap is an Open Source Suite created to facilitate managem…5.4
Are you affected by CVE-2025-53535?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST