PT-2025-62893 · Npm+1 · Better-Call+2

Goksan · CVE-2025-71399 · Published 2025-12-16 · Updated 2026-08-02

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.4.5

Description Better Auth utilizes the better-call library, which depends on the rou3 router. In affected versions of rou3, paths are normalized by removing empty segments, causing paths such as /path, //path, and ///path to resolve to the same route. This behavior allows attackers to bypass the disabledPaths configuration and path-based rate limits by including extra slashes in the URL path. This issue does not affect deployments where the proxy or platform automatically normalizes URLs by collapsing multiple slashes.

Recommendations Update Better Auth to version 1.4.5 or later. Ensure the proxy normalizes URLs by collapsing multiple slashes before they reach the handler.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-41

CWE-20

Related Identifiers

CVE-2025-71399

GHSA-X732-6J76-QMHM

Affected Products

Better Auth

Better-Call

Rou3

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71399.json · Exploit
• https://github.com/better-auth/better-auth/security/advisories/GHSA-x732-6j76-qmhm · Vendor Advisory
• https://github.com/better-auth/better-auth/commit/f60b43fa648399534507c9ac7db36d705b8874c3 · Patch
• https://osv.dev/vulnerability/CVE-2025-71399 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x732-6j76-qmhm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71399 · Security Note
• https://github.com/better-auth/better-auth · Note
• https://vulncheck.com/advisories/better-auth-before-path-normalization-bypass-via-rou3 · Note