PT-2025-41497 · Unknown · Better Auth

Etiennelunetta

·

Published

2025-10-09

·

Updated

2026-03-28

·

CVE-2025-61928

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.3.26
Description Better Auth is an authentication and authorization library for TypeScript. A critical authentication bypass allows unauthenticated attackers to create or modify API keys for any user. This is achieved by sending a request to the /api/auth/api-key/create route with a user ID in the request body. The application logic incorrectly handles the absence of a session, allowing the attacker-controlled userId from the request body to be used to create or modify API keys. Specifically, the code session?.user ?? (authRequired ? null : { id: ctx.body.userId }) sets the user object based on the userId in the request body when no session exists. This bypasses authentication checks and allows the attacker to generate API keys for any user, potentially compromising user data and application functionality. The same issue exists in the update endpoint. It is estimated that over 300,000 projects download this library weekly, potentially making a large number of applications vulnerable.
API Endpoints: /api/auth/api-key/create
Vulnerable Parameters or Variables: userId, ctx.body
Recommendations Update Better Auth to version 1.3.26 or later.

Exploit

Fix

Improper Authorization

Missing Authentication

Weakness Enumeration

CWE-285CWE-306

Related Identifiers

CVE-2025-61928
GHSA-99H5-PJCV-GR6V

Affected Products

Better Auth