CVE-2025-61928

Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. `session?.user ?? (authRequired ? null : { id: ctx.body.userId })`. When no session exists but `userId` is present in the request body, `authRequired` becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only executes when `authRequired` is true (lines 280-295), allowing attackers to set privileged fields. No additional authentication occurs before the database operation, so the malicious payload is accepted. The same pattern exists in the update endpoint. This is a critical authentication bypass enabling full an unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated access. This allows the attacker to perform any action as the victim user using the api key, potentially compromise the user data and the application depending on the victim's privileges. Version 1.3.26 contains a patch for the issue.

• CWE-285
• CWE-306

• https://github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39
• https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v
• https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v

Published

Oct 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61922PrestaShop Checkout is the PrestaShop official payment modul…9.1
• CVE-2025-61923PrestaShop Checkout is the PrestaShop official payment modul…4.1
• CVE-2025-61924PrestaShop Checkout is the PrestaShop official payment modul…3.8
• CVE-2025-61925Astro is a web framework. Prior to version 5.14.2, Astro ref…6.5
• CVE-2025-61926Allstar is a GitHub App to set and enforce security policies…4.6
• CVE-2025-61927Happy DOM is a JavaScript implementation of a web browser wi…7.2
• CVE-2025-61929Cherry Studio is a desktop client that supports for multiple…9.6
• CVE-2025-6193A command injection vulnerability was discovered in the Trus…5.9
• CVE-2025-61930Emlog is an open source website building system. Emlog Pro v…8.8
• CVE-2025-61931Pleasanter contains a stored cross-site scripting vulnerabil…5.4
• CVE-2025-61932Lanscope Endpoint Manager (On-Premises) (Client program (MR)…9.8
• CVE-2025-61933A reflected cross-site scripting (XSS) vulnerability exists …6.1