PT-2025-7795 · Unknown · Better Auth

Shivaraj-Kolekar + 1 · Published 2024-12-30 · Updated 2025-02-28 · CVE-2025-27143

Positive Technologies (AI Summary)

CVSS v4.0

7.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.1.21

Description The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts a callback URL. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens.

Recommendations Upgrade to Better Auth version 1.1.21 or later to enforce domain validation for callbackURL for the /verify-email path and for all other GET endpoints. As a temporary workaround, consider using hooks to pre-check URLs in your auth instance to prevent this without upgrading, by checking if the callbackURL is a trusted callback URL or not in the before hook.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-27143

GHSA-8JHW-6PJJ-8723

GHSA-HJPM-7MRM-26W8

Affected Products

Better Auth

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27143.json · Exploit
• https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8 · Vendor Advisory
• https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80 · Patch
• https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153 · Patch
• https://osv.dev/vulnerability/GHSA-8jhw-6pjj-8723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56734 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27143 · Security Note
• https://osv.dev/vulnerability/GHSA-hjpm-7mrm-26w8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27143 · Vendor Advisory
• https://github.com/better-auth/better-auth · Note
• https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723 · Note
• https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f · Note
• https://github.com/better-auth/better-auth/releases/tag/v1.1.21 · Note
• https://t.me/cvenotify/112810 · Telegram Post
• https://twitter.com/noobstain_/status/1894227417927225585 · Twitter Post