Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/772004?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/772004?format=api", "purl": "pkg:npm/better-auth@0.8.6", "type": "npm", "namespace": "", "name": "better-auth", "version": "0.8.6", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.4.9", "latest_non_vulnerable_version": "1.6.11", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/117301?format=api", "vulnerability_id": "VCID-69mc-pa6e-zyf3", "summary": "Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27143", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00205", "scoring_system": "epss", "scoring_elements": "0.42801", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00205", "scoring_system": "epss", "scoring_elements": "0.42631", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00205", "scoring_system": "epss", "scoring_elements": "0.42812", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00205", "scoring_system": "epss", "scoring_elements": "0.42792", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-27143" }, { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27143", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27143" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153", "reference_id": "24659aefc35a536b95ea4e5347e52c8803910153", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:45Z/" } ], "url": "https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80", "reference_id": "b381cac7aafd6aa53ef78b6ab771ebfa24643c80", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:45Z/" } ], "url": "https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723", "reference_id": "GHSA-8jhw-6pjj-8723", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:45Z/" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723" }, { "reference_url": "https://github.com/advisories/GHSA-hjpm-7mrm-26w8", "reference_id": "GHSA-hjpm-7mrm-26w8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hjpm-7mrm-26w8" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8", "reference_id": "GHSA-hjpm-7mrm-26w8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:45Z/" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8" }, { "reference_url": "https://github.com/better-auth/better-auth/releases/tag/v1.1.21", "reference_id": "v1.1.21", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:45Z/" } ], "url": "https://github.com/better-auth/better-auth/releases/tag/v1.1.21" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377247?format=api", "purl": "pkg:npm/better-auth@1.1.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-mk24-jqdu-euh7" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.1.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/783307?format=api", "purl": "pkg:npm/better-auth@1.2.0-beta.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.2.0-beta.1" } ], "aliases": [ "CVE-2025-27143", "GHSA-hjpm-7mrm-26w8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-69mc-pa6e-zyf3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/360586?format=api", "vulnerability_id": "VCID-736k-tj73-nuex", "summary": "Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)\n### Summary\nThe better-auth `/api/auth/error` page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.\n\n### Details\nThe value of `error` URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81\n\n### Impact\nAn attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.", "references": [ { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5" }, { "reference_url": "https://github.com/advisories/GHSA-9x4v-xfq5-m8x5", "reference_id": "GHSA-9x4v-xfq5-m8x5", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9x4v-xfq5-m8x5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377246?format=api", "purl": "pkg:npm/better-auth@1.1.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-69mc-pa6e-zyf3" }, { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-mk24-jqdu-euh7" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.1.16" } ], "aliases": [ "GHSA-9x4v-xfq5-m8x5" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-736k-tj73-nuex" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359918?format=api", "vulnerability_id": "VCID-hv9u-qvqb-c3by", "summary": "Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)\n### Summary\n\nUnder certain configurations, sessions may be considered valid before two-factor authentication (2FA) is fully completed. This can allow access to authenticated routes without verifying the second factor.\n\n---\n\n### Description\n\nWhen two-factor authentication is enabled, the authentication flow correctly identifies users who require additional verification and defers full authentication until the second factor is completed.\n\nHowever, when `session.cookieCache` is enabled, the session generated during the initial sign-in step may be cached as valid **prior to 2FA verification**. Subsequent session lookups may then return this cached session without re-evaluating the 2FA requirement.\n\nThis results in a situation where session validity can be established before all authentication constraints are satisfied.\n\n---\n\n### Impact\n\nAn attacker (or user) with valid primary credentials may gain access to protected application routes without completing the required second authentication factor.\n\nAny application using `better-auth` with both two-factor authentication and session cookie caching enabled may be affected.\n\n---\n\n### Mitigation\n\n* Upgrade to a version of `better-auth` that includes the fix for this issue.\n* Ensure that session caching does not treat sessions as fully authenticated until all required authentication steps, including 2FA, are completed.\n* As a temporary workaround, disable `session.cookieCache` when using two-factor authentication.", "references": [ { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "9.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83" }, { "reference_url": "https://github.com/advisories/GHSA-xg6x-h9c9-2m83", "reference_id": "GHSA-xg6x-h9c9-2m83", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xg6x-h9c9-2m83" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/374122?format=api", "purl": "pkg:npm/better-auth@1.4.9", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.4.9" } ], "aliases": [ "GHSA-xg6x-h9c9-2m83" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hv9u-qvqb-c3by" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/360613?format=api", "vulnerability_id": "VCID-mk24-jqdu-euh7", "summary": "Better Auth allows bypassing the trustedOrigins Protection which leads to ATO\n### Summary\n\nA bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.\n\nBecause redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.", "references": [ { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x" }, { "reference_url": "https://github.com/advisories/GHSA-vp58-j275-797x", "reference_id": "GHSA-vp58-j275-797x", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vp58-j275-797x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377418?format=api", "purl": "pkg:npm/better-auth@1.1.21", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/783307?format=api", "purl": "pkg:npm/better-auth@1.2.0-beta.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.2.0-beta.1" } ], "aliases": [ "GHSA-vp58-j275-797x" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mk24-jqdu-euh7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42548?format=api", "vulnerability_id": "VCID-qxvr-3p5w-vke6", "summary": "Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56734", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0016", "scoring_system": "epss", "scoring_elements": "0.369", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0016", "scoring_system": "epss", "scoring_elements": "0.36886", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0016", "scoring_system": "epss", "scoring_elements": "0.36872", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0016", "scoring_system": "epss", "scoring_elements": "0.36694", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-56734" }, { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56734", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56734" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f", "reference_id": "deb3d73aea90d0468d92723f4511542b593e522f", "reference_type": "", "scores": [ { "value": "7.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-30T17:36:35Z/" } ], "url": "https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f" }, { "reference_url": "https://github.com/advisories/GHSA-8jhw-6pjj-8723", "reference_id": "GHSA-8jhw-6pjj-8723", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8jhw-6pjj-8723" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723", "reference_id": "GHSA-8jhw-6pjj-8723", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "7.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-30T17:36:35Z/" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/372496?format=api", "purl": "pkg:npm/better-auth@1.1.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-69mc-pa6e-zyf3" }, { "vulnerability": "VCID-736k-tj73-nuex" }, { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-mk24-jqdu-euh7" }, { "vulnerability": "VCID-wq9k-qm9f-h3aa" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.1.6" } ], "aliases": [ "CVE-2024-56734", "GHSA-8jhw-6pjj-8723" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qxvr-3p5w-vke6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/105233?format=api", "vulnerability_id": "VCID-wq9k-qm9f-h3aa", "summary": "Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53535", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00309", "scoring_system": "epss", "scoring_elements": "0.54587", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00309", "scoring_system": "epss", "scoring_elements": "0.54586", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00309", "scoring_system": "epss", "scoring_elements": "0.54462", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00309", "scoring_system": "epss", "scoring_elements": "0.54603", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-53535" }, { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/9801d1be53d9da04686b94c6286c53ec97496740", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/commit/9801d1be53d9da04686b94c6286c53ec97496740" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53535", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53535" }, { "reference_url": "https://github.com/advisories/GHSA-36rg-gfq2-3h56", "reference_id": "GHSA-36rg-gfq2-3h56", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-36rg-gfq2-3h56" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56", "reference_id": "GHSA-36rg-gfq2-3h56", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "2.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-07-07T17:48:21Z/" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/378422?format=api", "purl": "pkg:npm/better-auth@1.2.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-xcfr-utg2-u7a8" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.2.10" } ], "aliases": [ "CVE-2025-53535", "GHSA-36rg-gfq2-3h56" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wq9k-qm9f-h3aa" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/212432?format=api", "vulnerability_id": "VCID-wvwj-npt5-qye2", "summary": "Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits", "references": [ { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/advisories/GHSA-x732-6j76-qmhm", "reference_id": "GHSA-x732-6j76-qmhm", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x732-6j76-qmhm" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-x732-6j76-qmhm", "reference_id": "GHSA-x732-6j76-qmhm", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-x732-6j76-qmhm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/36252?format=api", "purl": "pkg:npm/better-auth@1.4.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.4.5" } ], "aliases": [ "GHSA-x732-6j76-qmhm" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wvwj-npt5-qye2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/127951?format=api", "vulnerability_id": "VCID-xcfr-utg2-u7a8", "summary": "Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. `session?.user ?? (authRequired ? null : { id: ctx.body.userId })`. When no session exists but `userId` is present in the request body, `authRequired` becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only executes when `authRequired` is true (lines 280-295), allowing attackers to set privileged fields. No additional authentication occurs before the database operation, so the malicious payload is accepted. The same pattern exists in the update endpoint. This is a critical authentication bypass enabling full an unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated access. This allows the attacker to perform any action as the victim user using the api key, potentially compromise the user data and the application depending on the victim's privileges. Version 1.3.26 contains a patch for the issue.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61928", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42766", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42775", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42785", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42604", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-61928" }, { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39", "reference_id": "556085067609c508f8c546ceef9003ee8c607d39", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-10-10T14:23:17Z/" } ], "url": "https://github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61928", "reference_id": "CVE-2025-61928", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61928" }, { "reference_url": "https://github.com/advisories/GHSA-99h5-pjcv-gr6v", "reference_id": "GHSA-99h5-pjcv-gr6v", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-99h5-pjcv-gr6v" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v", "reference_id": "GHSA-99h5-pjcv-gr6v", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-10-10T14:23:17Z/" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/34159?format=api", "purl": "pkg:npm/better-auth@1.3.26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wvwj-npt5-qye2" }, { "vulnerability": "VCID-z32n-9h42-cbd3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.3.26" } ], "aliases": [ "CVE-2025-61928", "GHSA-99h5-pjcv-gr6v" ], "risk_score": 4.2, "exploitability": "0.5", "weighted_severity": "8.4", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xcfr-utg2-u7a8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/212400?format=api", "vulnerability_id": "VCID-z32n-9h42-cbd3", "summary": "Better Auth affected by external request basePath modification DoS", "references": [ { "reference_url": "https://github.com/better-auth/better-auth", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth" }, { "reference_url": "https://github.com/better-auth/better-auth/releases/tag/v1.4.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/releases/tag/v1.4.2" }, { "reference_url": "https://github.com/advisories/GHSA-569q-mpph-wgww", "reference_id": "GHSA-569q-mpph-wgww", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-569q-mpph-wgww" }, { "reference_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww", "reference_id": "GHSA-569q-mpph-wgww", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "2.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35628?format=api", "purl": "pkg:npm/better-auth@1.4.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-hv9u-qvqb-c3by" }, { "vulnerability": "VCID-wvwj-npt5-qye2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@1.4.2" } ], "aliases": [ "GHSA-569q-mpph-wgww" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z32n-9h42-cbd3" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/better-auth@0.8.6" }