better-auth CVE-2025-71403

The targeted application must be running better-auth at version 1.1.20 or earlier. The application must expose a callback or redirect endpoint that accepts a dynamic callbackURL parameter - most commonly password-reset initiation or OAuth callback flows - where the library's trustedOrigins validation is the only guard on the redirect destination. The attacker must be able to reach the callback endpoint over the network (no authentication required). The victim must click a crafted link (passive user interaction required; fully automated exploitation without a victim action is not possible per UI:P). For account takeover to succeed rather than merely an open redirect, the redirect response must include a sensitive token such as a password-reset credential in the URL. Exploitation is limited to: applications where callbackURL is accepted as user-controlled input, platforms running Node.js with this npm package, and victims susceptible to phishing.

The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N) accurately characterizes the risk profile. Exploitation is network-accessible with low complexity and no authentication requirement, but is gated by passive user interaction (UI:P) - the victim must click a phishing link. The high integrity impact (VI:H) reflects that successful exploitation yields account takeover, not merely a benign redirect. No EPSS score was provided in the available data. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, suggesting exploitation has not yet been observed at scale. Despite the meaningful CVSS score, the real-world risk is modulated by the phishing delivery requirement: exploitation demands social engineering, making mass automated exploitation unlikely. Organizations running password-reset or OAuth callback flows with better-auth should treat this as a meaningful priority given the account takeover potential, even without active exploitation evidence.

An attacker identifies a target using better-auth before 1.1.21 with a password-reset flow and crafts a callbackURL parameter that exploits the wildcard or absolute URL bypass to pass trustedOrigins validation while resolving to an attacker-controlled domain. The attacker emails the victim a password-reset link containing this malicious callbackURL. When the victim clicks the link, the application validates the URL (incorrectly permitting it), performs the redirect with the password-reset token appended, and the attacker's server captures the token and immediately uses it to reset the victim's password and seize the account.