Better Auth EUVD-2025-210592

Exploitation requires that Better Auth's baseURL is NOT explicitly configured AND the BETTER_AUTH_URL environment variable is unset, so the library falls back to deriving its base path from the client-supplied X-Forwarded-Host and X-Forwarded-Proto headers. The malicious request must be the very first request the server processes after startup/restart, because the poisoned value is cached until restart - this timing requirement is the main limiter. Exploitation is further prevented on typical managed hosting platforms and in any environment where baseURL is set, where the vulnerable fallback is never reached. No authentication or user interaction is needed (PR:N/UI:N).

The provided CVSS 4.0 vector (9.3 Critical, VC:H/VI:H/VA:H) overstates real impact: the described consequence is purely availability (all routes return 404), not confidentiality or integrity loss, so the H ratings for VC and VI are inconsistent with the description and should be treated as inflated - the realistic impact is availability-only DoS. Exploitation is unauthenticated and network-reachable (PR:N/UI:N), which raises priority, but two strong limiting factors reduce practical risk: it only works when baseURL/BETTER_AUTH_URL is left unset, and the malicious request must be the FIRST request the server processes after startup, which is a timing/race condition. The advisory explicitly notes the fallback is unreachable in properly configured environments and on typical managed hosting platforms. No EPSS score was supplied and there is no KEV listing; a public reproduction exists but there is no evidence of active exploitation. Net: a real, easy-to-exploit availability bug for the narrow population running unconfigured baseURL, not a widespread critical-impact issue despite the 9.3 score - verify the CVSS discrepancy with the vendor.

Immediately after a Better Auth service (deployed without baseURL/BETTER_AUTH_URL) restarts, an attacker races to send the first HTTP request to /api/auth/ok with headers 'X-Forwarded-Proto: some:' and 'X-Forwarded-Host: junk'. This poisons the cached basePath so all auth endpoints return 404 for every user until the next restart; the attacker can repeat the request after each restart for persistent denial of service. A working proof-of-concept curl sequence is published in the advisory.