CVE-2025-71403
Last modified
CVE-2025-71403 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| better-auth | better-auth | < 1.1.20 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2025-71403?
How severe is CVE-2025-71403?
How do I fix CVE-2025-71403?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-71398SurrealDB before 2.2.2 fails to validate HTTP redirects in h…5.8
- CVE-2025-71399Better Auth relies on better-call, which uses the rou3 route…8.8
- CVE-2025-7140A vulnerability classified as problematic has been found in …5.4
- CVE-2025-71400better-auth passkey versions before 1.4.0 contain an insecur…7.1
- CVE-2025-71401better-auth (npm) before 1.4.2 allows an external request to…9.3
- CVE-2025-71402better-auth versions greater than 1.3.34 and before 1.4.0 co…2
- CVE-2025-71404better-auth versions after v0.0.2 and before 1.1.16 contain …5.1
- CVE-2025-71408NLTK (Natural Language Toolkit) before version 3.9.3 contain…8.5
- CVE-2025-71409Lack of authentication for Very High Frequency Data Link mes…7.1
- CVE-2025-7141A vulnerability classified as problematic was found in Sourc…5.4
- CVE-2025-71410Unnumbered Disconnect (U DISC) and malformed Aviation Very H…6
- CVE-2025-71411Broadcast control frames can disconnect multiple aircraft si…6
Are you affected by CVE-2025-71403?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST