Goksan

**Name of the Vulnerable Software and Affected Versions** Better Auth versions prior to 1.4.5 **Description** Better Auth utilizes the better-call library, which depends on the rou3 router. In affected versions of rou3, paths are normalized by removing empty segments, causing paths such as `/path`, `//path`, and `///path` to resolve to the same route. This behavior allows attackers to bypass the `disabledPaths` configuration and path-based rate limits by including extra slashes in the URL path. This issue does not affect deployments where the proxy or platform automatically normalizes URLs by collapsing multiple slashes. **Recommendations** Update Better Auth to version 1.4.5 or later. Ensure the proxy normalizes URLs by collapsing multiple slashes before they reach the handler.

**Name of the Vulnerable Software and Affected Versions** better-auth (npm) versions prior to 1.4.2 **Description** An issue exists where an external request can configure the `baseURL` when it is not explicitly defined (for example, when `BETTER AUTH URL` is unset). This occurs because the system implicitly trusts the `X-Forwarded-Host` and `X-Forwarded-Proto` headers. An attacker who can send the first request to the server after startup can use these headers to poison the router's base path. This results in a denial of service where all subsequent routes return a 404 error for all users until the server is restarted. This issue is not reachable on typical managed hosting platforms or when `baseURL` is explicitly configured. **Recommendations** Update better-auth (npm) to version 1.4.2 or later. Explicitly configure the `baseURL` (e.g., via `BETTER AUTH URL`) to prevent the system from relying on request headers for configuration.

**Name of the Vulnerable Software and Affected Versions** better-auth passkey versions prior to 1.4.0 **Description** An insecure direct object reference occurs in the passkey deletion endpoint, allowing authenticated users to delete arbitrary passkeys. Attackers with valid sessions can send crafted requests to the '/passkey/delete-passkey' endpoint by enumerating passkey IDs. The issue stems from the `ctx.body.id` variable being implicitly trusted during deletion queries. Applications configured with `useNumberId` are particularly susceptible as they may use auto-incrementing IDs, simplifying the process of deleting all passkeys through enumeration. **Recommendations** Update better-auth passkey to version 1.4.0 or later.