CVE-2025-71403
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 1, 2026
- Updated
- Aug 3, 2026
- Reserved
- Jul 18, 2026
Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
better-authbetter-auth |
|
References
- GitHub Security Advisory (GHSA-vp58-j275-797x)vendor-advisory
- VulnCheck Advisory: better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.