Path Normalization Bypass in Better Auth

Executive Summary

This vulnerability affects Better Auth, which uses the rou3 router library. In older versions of rou3, URL paths with multiple slashes (like //path or ///path) are treated the same as a single slash path (/path). This allows attackers to bypass security measures like disabledPaths configuration and path-based rate limits by adding extra slashes to URLs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP request logs for URLs with multiple consecutive slashes in paths (e.g., //path, ///path). Check if requests bypass intended path-based restrictions in Better Auth deployments using rou3 versions prior to 1.4.5. Use tools like curl to send test requests with extra slashes and verify if they reach unintended routes.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to access restricted routes or bypass rate limits, potentially leading to unauthorized actions or service disruptions. The impact depends on how Better Auth is configured in your system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Better Auth to version 1.4.5 or later, which includes the fixed rou3 library. If upgrading is not immediately possible, configure your proxy or web server to normalize URLs by collapsing multiple slashes before they reach the application. Review and enforce path-based rate limits and disabledPaths configurations.

Useful 0 Not Useful 0