PT-2025-62895 · Npm · Better Auth
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
better-auth (npm) versions prior to 1.4.2
Description
An issue exists where an external request can configure the
baseURL when it is not explicitly defined (for example, when BETTER AUTH URL is unset). This occurs because the system implicitly trusts the X-Forwarded-Host and X-Forwarded-Proto headers. An attacker who can send the first request to the server after startup can use these headers to poison the router's base path. This results in a denial of service where all subsequent routes return a 404 error for all users until the server is restarted. This issue is not reachable on typical managed hosting platforms or when baseURL is explicitly configured.Recommendations
Update better-auth (npm) to version 1.4.2 or later.
Explicitly configure the
baseURL (e.g., via BETTER AUTH URL) to prevent the system from relying on request headers for configuration.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Better Auth