PT-2025-62894 · Unknown · Better Auth

Goksan · CVE-2025-71400 · Published 2025-11-25 · Updated 2026-08-02

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions better-auth passkey versions prior to 1.4.0

Description An insecure direct object reference occurs in the passkey deletion endpoint, allowing authenticated users to delete arbitrary passkeys. Attackers with valid sessions can send crafted requests to the '/passkey/delete-passkey' endpoint by enumerating passkey IDs. The issue stems from the ctx.body.id variable being implicitly trusted during deletion queries. Applications configured with useNumberId are particularly susceptible as they may use auto-incrementing IDs, simplifying the process of deleting all passkeys through enumeration.

Recommendations Update better-auth passkey to version 1.4.0 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-71400

GHSA-4VCF-Q4XF-F48M

Affected Products

Better Auth

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71400.json · Exploit
• https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71400 · Security Note
• https://osv.dev/vulnerability/GHSA-4vcf-q4xf-f48m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71400 · Vendor Advisory
• https://github.com/better-auth/better-auth/commit/06d68239e · Note
• https://github.com/better-auth/better-auth · Note
• https://t.me/CVEtracker/62070 · Telegram Post
• https://vulncheck.com/advisories/better-auth-passkey-before-idor-via-delete-passkey · Note