EUVD-2025-210582
GHSA-g2jv-pgqw-qxhv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered, unauthenticated, low complexity, but requires victim click (UI:R); integrity high due to account takeover; confidentiality low for token exposure; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on better-auth (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.1.21.
DescriptionCVE.org
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
AnalysisAI
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover when a victim follows a crafted link. The trustedOrigins validation logic - responsible for gatekeeping callbackURL parameters - contains bypass flaws in both its absolute URL matching and wildcard domain pattern handling, allowing an attacker-supplied URL to pass origin checks and redirect victims to an attacker-controlled destination. Because callback redirects in authentication flows commonly carry sensitive tokens such as password-reset credentials, a successful redirect exfiltrates those tokens and allows full account compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
better-auth (CPE: cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*) is an open-source authentication framework distributed via npm, designed for Node.js applications. It implements its own trusted-origin validation to prevent callers from supplying arbitrary redirect destinations in callbackURL parameters - a common pattern in password-reset and OAuth callback flows. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes the root cause: the validation logic does not sufficiently normalize or sanitize input URLs before comparing them against the configured trustedOrigins list, allowing specially crafted URLs to satisfy checks while still resolving to an untrusted destination. The flaw manifests in two distinct paths: the absolute URL comparison logic and the wildcard domain pattern matching, meaning defensive configurations relying on either mechanism are bypassed.
RemediationAI
Upgrade better-auth to version 1.1.21 or later, which contains the fix committed at https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80. The vendor advisory is at https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x. If immediate upgrade is not feasible, the most effective compensating control is to replace dynamic callbackURL parameters with server-side hard-coded redirect targets, eliminating attacker influence over redirect destinations entirely - note this may break OAuth flows that depend on dynamic callback registration. Additionally, implement server-side allowlist enforcement at the application layer (independent of the library) that rejects any callbackURL not exactly matching a known-safe URI. Monitoring authentication endpoint logs for redirect parameters containing external domains can surface exploitation attempts.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today