EUVD-2025-210590
GHSA-9fq7-6g6p-g9rm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, zero-privilege, no interaction required; availability impact is high due to rate-limit bypass enabling DoS; confidentiality and integrity both low reflecting conditional access to disabled paths.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 20 npm packages depend on better-auth (10 direct, 10 indirect)
Ecosystem-wide dependent count for version 1.4.5.
DescriptionCVE.org
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.
AnalysisAI
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent disabledPaths security controls and path-based rate limits by submitting requests with extra leading slashes (e.g., //sign-in/email instead of /sign-in/email). The root cause is in the bundled rou3 router library, which collapses empty path segments before route matching, meaning security rules keyed on canonical paths never match the double-slash variants. No public exploit code has been identified at time of analysis, but the trivially low attack complexity makes exploitation straightforward on unprotected deployments.
Technical ContextAI
Better Auth (cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*) is a TypeScript authentication framework for Node.js that delegates HTTP routing to better-call, which in turn uses the rou3 library. Affected versions of rou3 prior to the fix (rou3 ^0.5.1 as pinned by better-call) normalize URL paths by stripping empty segments - so //sign-in/email becomes /sign-in/email at the routing layer. Because this normalization occurs after security policy evaluation, any path rules - including disabledPaths and rate-limit middleware - that operate on the raw incoming path string never see the normalized form and fail to match, allowing the request to pass through. CWE-20 (Improper Input Validation) is the root cause class: the framework trusts that incoming path strings are canonical without enforcing that invariant at the policy-evaluation boundary.
RemediationAI
Upgrade to Better Auth v1.4.5 or later, which bundles the patched rou3 version; this is the primary and recommended fix per advisory GHSA-x732-6j76-qmhm. For teams unable to upgrade immediately, two compensating controls are available. First, configure the upstream proxy or CDN to normalize URLs before they reach the Better Auth handler - Cloudflare's 'Normalize URLs to origin' setting and Vercel/Next.js default behavior both accomplish this at no code cost; trade-off is dependence on infrastructure configuration remaining consistent. Second, inject a middleware shim before the Better Auth handler that rewrites the request URL, collapsing repeated slashes via url.pathname.replace(//+/g, '/') as shown in the advisory - trade-off is an added per-request string operation and the need to maintain custom middleware. Both workarounds address the symptom (non-canonical paths reaching the framework) rather than the root cause; upgrading remains the definitive fix. Patch commit reference: https://github.com/better-auth/better-auth/commit/f60b43fa648399534507c9ac7db36d705b8874c3.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days afte
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today