Vulnerability Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-79
- https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-truste
FAQ
What is CVE-2025-71403?
CVE-2025-71403 is a vulnerability with a CVSS score of 7.1 (HIGH). better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL paramet...
How severe is CVE-2025-71403?
CVE-2025-71403 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71403?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.