CVE-2025-71403
Received Received - Intake

better-auth Origin Validation Bypass Leads to Open Redirect

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2025-71403
EUVD
EUVD-2025-210582

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
better-auth better-auth to 1.1.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

better-auth versions before 1.1.20 have a bypass flaw in the trustedOrigins validation logic. Attackers can manipulate callbackURL parameters to pass origin checks and perform open redirects. This allows stealing sensitive tokens for account takeover.

Impact Analysis

Attackers could trick users into clicking malicious links, leading to unauthorized access to accounts via stolen tokens. This may result in data breaches, unauthorized actions, or loss of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for non-compliance.

Mitigation Strategies

Upgrade better-auth to version 1.1.20 or later to address the trustedOrigins validation bypass. Review callbackURL parameters for absolute URLs and wildcard domains to ensure they are properly validated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart