CVE-2025-71401

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww
https://www.vulncheck.com/advisories/better-auth-before-basepath-modification-dos

Configurations

No configuration.

History

29 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) better-auth (npm) anterior a 1.4.2 permite que una solicitud externa configure baseURL cuando no está definida de otra manera (por ejemplo, BETTER_AUTH_URL no está configurada). Un atacante capaz de realizar la primera solicitud al servidor después del inicio puede envenenar la ruta base del router, haciendo que todas las rutas devuelvan 404 para todos los usuarios (denegación de servicio). El problema no es alcanzable cuando baseURL está configurada explícitamente o en plataformas de alojamiento gestionado típicas.

Information

Published : 2026-08-02 13:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-71401

Mitre link : CVE-2025-71401

CVE.ORG link : CVE-2025-71401

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-71401", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71401", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T14:29:29.017546Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "better-auth", "product": "better-auth", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.2", "versionType": "semver"}, {"status": "unaffected", "version": "1.4.2", "versionType": "semver"}], "packageURL": "pkg:npm/better-auth", "defaultStatus": "unaffected"}]}], "published": "2026-08-02T13:16:52.530", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/better-auth-before-basepath-modification-dos", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms."}, {"lang": "es", "value": "better-auth (npm) anterior a 1.4.2 permite que una solicitud externa configure baseURL cuando no est\u00e1 definida de otra manera (por ejemplo, BETTER_AUTH_URL no est\u00e1 configurada). Un atacante capaz de realizar la primera solicitud al servidor despu\u00e9s del inicio puede envenenar la ruta base del router, haciendo que todas las rutas devuelvan 404 para todos los usuarios (denegaci\u00f3n de servicio). El problema no es alcanzable cuando baseURL est\u00e1 configurada expl\u00edcitamente o en plataformas de alojamiento gestionado t\u00edpicas."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}