EUVD-2025-210591
GHSA-44ff-3cmc-mgqf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint, low complexity; PR:L for required valid session; I:H for arbitrary passkey deletion; A:L for partial authentication disruption; no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.
AnalysisAI
Insecure Direct Object Reference in the better-auth passkey plugin (npm/@better-auth/passkey < 1.4.0) permits any authenticated user to delete arbitrary passkeys belonging to other users via the POST /passkey/delete-passkey endpoint. The ctx.body.id parameter is implicitly trusted without ownership verification, meaning a valid session - regardless of privilege level - is sufficient to enumerate and destroy other users' passkey credentials. Applications configured with useNumberId (auto-incrementing integer IDs) are trivially exploitable by sequential enumeration. No public exploit or CISA KEV listing confirmed at time of analysis; a vendor-released patch exists at version 1.4.0.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key): the passkey deletion handler accepts a client-supplied passkey ID and queries the deletion directly without asserting that the requesting session owns that passkey. The affected component is the @better-auth/passkey npm plugin for the better-auth authentication framework (CPE: cpe:2.3:a:better-auth:passkey:*:*:*:*:*:*:*:*, all versions < 1.4.0). The POST /passkey/delete-passkey endpoint is the specific attack surface. When the application enables useNumberId, passkey IDs are sequential integers rather than UUIDs, making full enumeration and bulk deletion of all passkeys in the system straightforward with a loop of crafted requests. UUID-based deployments face higher enumeration difficulty but remain vulnerable if IDs are leaked through other application surfaces.
RemediationAI
Upgrade @better-auth/passkey to version 1.4.0 or later, which contains the fix introduced in commit 06d68239e (https://github.com/better-auth/better-auth/commit/06d68239e). The vendor advisory is available at https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m. If an immediate upgrade is not feasible, a compensating control is to place authentication middleware at the /passkey/delete-passkey endpoint that validates the requesting session owns the supplied passkey ID before executing deletion - this adds a server-side ownership assertion the library currently omits. Disabling the passkey plugin entirely eliminates the attack surface at the cost of removing passkey-based authentication for all users. Applications using useNumberId should treat this with heightened urgency given the trivial enumeration path; switching to UUID-based IDs without patching does not fix the root authorization flaw.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today