CVE-2025-71403

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass

Configurations

No configuration.

History

29 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de better-auth anteriores a la 1.1.20 contienen una vulnerabilidad de omisión en la lógica de validación de trustedOrigins que afecta a las URLs absolutas y a los dominios comodín. Los atacantes pueden construir parámetros callbackURL maliciosos que pasan las comprobaciones de origen y desencadenan redirecciones abiertas para robar tokens sensibles para la toma de control de cuentas.

Information

Published : 2026-08-01 13:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-71403

Mitre link : CVE-2025-71403

CVE.ORG link : CVE-2025-71403

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-71403", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71403", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T18:18:37.173747Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "better-auth", "product": "better-auth", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.20", "versionType": "semver"}, {"status": "unaffected", "version": "1.1.20", "versionType": "semver"}], "packageURL": "pkg:npm/better-auth", "defaultStatus": "unaffected"}]}], "published": "2026-08-01T13:16:56.607", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover."}, {"lang": "es", "value": "Las versiones de better-auth anteriores a la 1.1.20 contienen una vulnerabilidad de omisi\u00f3n en la l\u00f3gica de validaci\u00f3n de trustedOrigins que afecta a las URLs absolutas y a los dominios comod\u00edn. Los atacantes pueden construir par\u00e1metros callbackURL maliciosos que pasan las comprobaciones de origen y desencadenan redirecciones abiertas para robar tokens sensibles para la toma de control de cuentas."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}