Insecure Direct Object Reference in better-auth Passkey Deletion Endpoint

Executive Summary

better-auth passkey versions before 1.4.0 have an insecure direct object reference flaw in the passkey deletion endpoint. Authenticated users can exploit this by submitting crafted requests to delete arbitrary passkeys using their IDs. Attackers with valid sessions can enumerate passkey IDs and remove other users' passkeys.

Useful 0 Not Useful 0

Detection Guidance

Check application logs for unauthorized passkey deletion attempts. Monitor for HTTP DELETE requests to the /delete-passkey endpoint with arbitrary passkey IDs. Inspect network traffic for suspicious patterns targeting the passkey management API.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to delete other users' passkeys, potentially locking them out of their accounts. This could lead to loss of access to critical services, data, or authentication methods tied to those passkeys.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized deletion of user credentials, potentially violating data integrity and access control requirements in GDPR and HIPAA. Loss of authentication methods may also breach availability and security obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade better-auth passkey to version 1.4.0 or later. Implement input validation to prevent IDOR attacks. Review and restrict user permissions to prevent unauthorized passkey deletions. Monitor for any ongoing exploitation attempts.

Useful 0 Not Useful 0