PT-2025-30365 — Better-Call

PT-2025-30365 · Npm · Better-Call

Published

2025-07-11

Updated

2025-07-11

CVSS v4.0

4.9

Medium

Vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Summary

Using a CDN that caches (/**/*.png, /**/*.json, /**/*.css, etc...) requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and personal data when cached responses are served to other users.

Details

The vulnerability occurs in the request processing logic where path sanitization is insufficient. The library splits the path using config.basePath but doesn't properly validate the remaining path components. This allows specially crafted requests that appear to be static assets (like /api/auth/get-session/api/auth/image.png assuming config.basePath=/api/auth) to bypass typical CDN cache exclusion rules while actually returning sensitive data.

The problematic code here:

	const processRequest = async (request: Request) => {
		const url = new URL(request.url);
		const path = config?.basePath ? url.pathname.split(config.basePath)[1] : url.pathname;

Since this library is largely coupled with better-auth, it becomes more clear why this can be dangerous with an example request: